Software vulnerability in which a program's behavior depends on the unintended ordering or timing of concurrent events, which an attacker can exploit to alter system state between a check and its use.
A race condition arises when two processes or threads access a shared resource simultaneously without adequate synchronization, and the outcome depends on the precise sequence in which operations execute. The most common variant is known as TOCTOU, for time-of-check to time-of-use: a program checks the state of a resource, such as the existence or permissions of a file, and then uses it, while the attacker interposes in that brief interval to substitute the resource. In cryptography, timing attacks are a particularly subtle sub-category: by precisely measuring variations in the response time of a cryptographic operation, an adversary can infer information about the secret key without ever interacting with it directly. This class of attack, theorized by Paul Kocher in 1996 against RSA implementations, has since demonstrated the necessity of constant-time code for any sensitive cryptographic primitive. In decentralized finance, race conditions have a direct economic dimension: first-order arbitrageurs and MEV attackers, for Miner Extractable Value, exploit the window between the submission of a transaction in the mempool and its inclusion in a block to slip their own transaction in with priority, a phenomenon known as front-running. For insurers and software publishers, race conditions are a vulnerability class that is difficult to detect through static code audit, often absent from standard CVE scans and under-represented in cyber underwriting questionnaires, making them an unmeasured residual risk in many financial lines and product liability portfolios.
In 2016, the vulnerability exploited in The DAO on Ethereum was a race condition: a withdrawal function only updated the balance after transferring funds, allowing an attacker to recursively trigger the same function before the update. The result was the theft of 60 million dollars in ether, leading to a controversial hard fork of the chain to reverse the transaction.
race condition, condition de course, TOCTOU, time-of-check time-of-use, vulnérabilité temporelle