https://florencenjeri.com/tags/toctou/ Recent content in TOCTOU on Florence Njeri Hugo -- gohugo.io en Mon, 06 Jul 2026 00:00:00 +0000 https://florencenjeri.com/posts/abusing-toctou-vulnerabilities-in-financial-agents/ Mon, 06 Jul 2026 00:00:00 +0000 https://florencenjeri.com/posts/abusing-toctou-vulnerabilities-in-financial-agents/ I want to pay Fragment_A $1000 AND Fragment_B $1000, but I only have $1000. Double spending is a technique that will let me successfully do both concurrently before the banking or blockchain system validation tool catches the discrepancy. The exploit and result: TOCTOU Race Condition via Parallel Tool Calls # Step 1: Reconnaissance of the trading tools I queried the model about the difference between the create_order and execute_order tools to understand which of the two tools commits the transaction for money to leaves my account. I found out that create_order only creates an order and execute_order commits the orders using the order_ids, I created two orders - one for FRAGMENT_A and one for FRAGMENT_B - without any funds being deducted from my account: