Asynchronous transaction callbacks allow duplicate purchases and sales

[CYooBin10]

Labels: critical, bug, race-condition, economy

Description

Economy operations are asynchronous, but the plugin does not lock a player's transaction while a request is being processed.

A player can click purchase or sale buttons multiple times before the first callback completes.

Impact

• Duplicate purchases.
• Duplicate sales.
• Repeated balance changes.
• Race conditions between balance checks and balance updates.
• Negative or inconsistent balances depending on the economy provider.

Expected behavior

Implement a per-player transaction lock or unique transaction ID.

Each transaction should verify that:

• The player is still online.
• The menu session is still valid.
• The item and price have not changed.
• The request has not already been processed.

The lock should be released after success, failure, or timeout.