01 / Attack path
How the boundary is crossed
Two billing agents both see $10,000 remaining and each submits an $8,000 refund.
- 01Lower-trust input
- 02Attempted instruction
- 03Protected action
- 04Enforced decision
02 / Containment
Where bounded authority limits the effect
Atomically reserve against one budget before effect, settle or release reservations after known outcomes and reconcile unknown ones.
03 / Failure and evidence
The attacker’s opportunity and the defender’s record
Independent child-local counters turn one $10,000 permission into $16,000 of refunds.
Record reservation IDs, competing attempts, executor outcomes and authoritative remaining balance.
04 / Canonical scope
Why this reference stands alone
Shared authority budgets explains the accounting model; this threat isolates the concurrency exploit.
Protocol or attack trace
Parallel reservation race
Two refund children read $10,000 available, then each tries to spend $8,000.
Atomic reservation permits only one; second sees $2,000 and is denied.
Primary references