Double spend

What it means

A double spend means using the same balance, credit, voucher or token more than once. The application checks the balance, finds enough, and then deducts it. If two requests arrive at nearly the same moment, both may pass the check before either deduction is recorded.

The term began in digital currencies, but the flaw is ordinary in web apps. It is a race condition in a business rule: the gap between checking a value and changing it is long enough for a second request to slip through.

Why it matters

The cost is direct. A wallet balance spent twice, a gift voucher redeemed in two baskets, a withdrawal paid out twice, a free trial claimed in parallel. The business pays out more than it ever received, and no single transaction looks wrong on its own.

It is also hard to catch. Each request is valid alone, tests run one request at a time and never trigger it, and the shortfall appears later in the books. See time-of-check to time-of-use for the general class of flaw.

How it shows up

It appears wherever a limited thing is consumed: balances, credits, stock, coupon uses, invitations, one-time links, withdrawal limits. A request reads the value, decides, then writes. Under load, or on purpose, two requests interleave. The rule is correct in the code that checks it and wrong in the time it takes to apply it.

Make check and change a single atomic step: a conditional update in the database such as "deduct 50 only if the balance is at least 50", a lock on the row, or a transaction with the right isolation level. Add a unique key so a repeated payment cannot be recorded twice. Test by firing identical requests at once and examining the final balance.