# Race Condition Wallet (CTF challenge)

> CoinVault's 'one-time' +500 bonus voucher checks whether it's been redeemed and THEN credits your balance — with no lock. You start with 100 coins; the vault key costs 1000.

Canonical: https://codelivly.com/ctf/challenges/race-condition-wallet

| | |
|---|---|
| Category | Web Exploitation |
| Difficulty | Hard |
| Points | 1500 |
| Estimated time | 45 min |
| Type | Live instance |
| Solves | 24 |
| Author | Codelivly |

CoinVault's 'one-time' +500 bonus voucher checks whether it's been redeemed and THEN credits your balance — with no lock. You start with 100 coins; the vault key costs 1000. Redeem the voucher the RIGHT way (many requests at once) so the bonus lands multiple times before the app marks it used, then buy the key and read the flag. Your own isolated instance; the flag is unique to you. POST api/reset lets you retry.

## Related

- [All CTF challenges](https://codelivly.com/practice?type=ctf)