Transaction security
Deposit, transfer, and withdrawal paths are followed end to end, with concurrency and authorization assumptions tested.
Industry · Financial services
Find the flaws in how money moves.
Investigate transaction flows, authorization chains, and business rules for race conditions, authorization gaps, and data exposure, with reproducible evidence.
- acme
- /payments-core
- /Vulnerabilities
- /WF-2210
Critical
Sourceapi/transfers.ts:22
req.body.amount
1
Balance read outside the transaction
const balance = await ledger.balance(from)ledger/transfer.ts:482
Check passes for every request in flight
if (balance >= amount)ledger/transfer.ts:51Sinkledger/transfer.ts:58
await ledger.debit(from, amount)
Concurrent transfers overdraw an account
CriticalCVSS 9.0
- Weakness
- CWE-362 · Race condition
- Confidence
- 97
- Validation
- Exploitable
- Proof
- 20 parallel transfers moved 20× the balance
The problem
Financial logic breaks in ways scanners don't model.
Double-spends, reward abuse, and replayed payments look like correct code line by line. winfunc reasons about the flow: what state changes, in what order, under whose authority. That is how it found payment-logic flaws in open-source commerce platforms.
Included
What winfunc covers.
- TOCTOU and race-condition investigation in transaction paths
- Authorization review for transaction endpoints and service boundaries
- Price, reward, coupon, and transfer business-rule review
- Sensitive-data flow review for PII, PAN, and account identifiers
- Session fixation and replay-risk investigation
- Cryptographic-use review for key handling and token generation
- PCI DSS evidence from findings and verified fixes
Outcomes
What your team walks away with.
PCI DSS support
Finding details, remediation status, and verification evidence feed your PCI assessment and QSA review.
Business-logic review
Price manipulation, reward abuse, and unauthorized fund movement are investigated with proof where testing is in scope.
Proof of value
Evaluate winfunc on one representative service and judge it by supported risk found, not alert volume.
Found by winfunc in open source
All findingsContinue the evaluation
Start with one repository
Bring us your hardest codebase.
We'll bring the proof.
Scope a first audit with our security engineers. You get findings with traces, reproduction evidence, and patches ready for review.