# Tenderpay — Race Condition (lab)

> Tenderpay gives every new user a one-time signup bonus of 100 credits. The redeem endpoint checks whether you have already claimed it, does some slow processing, then credits your wallet — with no…

Canonical: https://codelivly.com/labs/race-condition

| | |
|---|---|
| Type | Web |
| Difficulty | Intermediate |
| Points | 300 |
| Session length | 30 min |
| Completions | 4 |

Tenderpay gives every new user a one-time signup bonus of 100 credits. The redeem endpoint checks whether you have already claimed it, does some slow processing, then credits your wallet — with no lock in between. Send several redeem requests at once and claim the "one-time" bonus more than once; drive your balance above 100 and the wallet unlocks the flag.

## Objective

Learn race conditions (TOCTOU — time-of-check to time-of-use): when code checks a condition and then acts on it without holding a lock, concurrent requests can all pass the check before any of them changes the state, so a "once only" action happens several times.

## Tasks

1. Redeem once, look at the balance
2. Spot the window
3. Send many at once
4. Over-credit the wallet
5. Capture the flag

## Related

- [All labs](https://codelivly.com/practice?type=lab)