Agent WranglersAbuse and limits Required
Make each change happen exactly once
Changes to money, stock and single-use items must happen once, even when the same request arrives twice at the same moment.
How to do it
Do the check and the change in one atomic database step, such as a conditional update or a unique constraint. Give payment requests an idempotency key, so a repeat returns the first result. Avoid reading a value, deciding, and writing it back in separate steps. For more depth, see conditional writes.
Example
-- One step: the coupon is used only if it was still unused
UPDATE coupons SET used_by = :user WHERE code = :code AND used_by IS NULL;
-- 0 rows changed means someone else already used itHow to check
Send the same coupon or withdrawal request 10 times at once with a test account. Only one succeeds, and the balance is right.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/abuse-and-limits/race-conditions.