Severity: HIGH
Location: src/Models/UserCredit.php:80-93
Bug: logTransaction re-queries balance after the UPDATE; concurrent spend can log an incorrect running balance.
Fix: Pass the post-deduction balance directly into logTransaction.
Status: open. Will reply with remediation details when resolved.
Resolved.
UserCredit::spend now passes the computed post-spend balance directly into logTransaction() via a new optional $balanceOverride parameter (src/Models/UserCredit.php). The SQL UPDATE is also checked against rowCount() — a lost atomic race now returns false instead of silently logging a spend that didn't happen.
Under concurrent spends the credit_transactions.balance snapshot is now the caller's own post-transaction balance, not whatever findByUser happens to return a moment later.
Locking this thread.
We noticed you are visiting from a mobile device. We are glad you are here, but know that 6502ish is best experienced on the desktop. Some features are not easily used via mobile and your experience may vary from the full experience via desktop.