Return to Question

Yesterday, I put a 100-rep bounty on an answer in order to give association bonus and network flair rights to our newly-appointed community manager, Cesar M.

While awarding the bounty, I clicked the button, then clicked OK on the dialog. The page refreshed, but nothing appeared to have happened. I tried again, clicked through the dialog, and it appeared as if the bounty was awarded.

I then saw something weird: my name was showing up twice on the bounty tooltip, despite my only having started one bounty. Also, Cesar's reputation page shows two separate +100 bounty gains within seconds, each corresponding to the same bounty, and the revision history of that answer shows two "bounty ended" events. Finally, weirdly, the bounty icon on the answer itself only shows +100 instead of the actual award of +200. Effectively, I was able to award the same bounty twice to the same user by (unintentionally) exploiting a race condition.

Can there be some extra checking to make sure that the bounty isn't awarded twice, so that one can't intentionally exploit this race condition? Can we also delete extraneous bounty votes corresponding to when this race condition was exploited, both intentionally and unintentionally?

Update: With the help of rene, I found that, while this situation of a double-bounty is rare, it has occurred on occasion fairly often (around once a year on average for the past few years). In particular, this has occurred a total of nine times (four times on Stack Overflow, twice on Mathematics, and once each on Worldbuilding, Mi Yodeya, and Board & Card Games - that last one was my instance). There might be other instances where the same bounty was awarded to multiple answers (i.e. after nothing appeared to have happened on the first attempt, the bounty owner selected a different answer to award it), but as the system doesn't keep track of what bounty vote corresponds to what actual bounty, that can't be queried for.

I still think that the overarching bug should be fixed, as this might be exploitable by users, based on what happened with me and how my instance occurred. In the meantime, can we please at least delete these nine erroneous bounty votes, leaving these answers with just one bounty award?

Yesterday, I put a 100-rep bounty on an answer in order to give association bonus and network flair rights to our newly-appointed community manager, Cesar M.

While awarding the bounty, I clicked the button, then clicked OK on the dialog. The page refreshed, but nothing appeared to have happened. I tried again, clicked through the dialog, and it appeared as if the bounty was awarded.

I then saw something weird: my name was showing up twice on the bounty tooltip, despite my only having started one bounty. Also, Cesar's reputation page shows two separate +100 bounty gains within seconds, each corresponding to the same bounty, and the revision history of that answer shows two "bounty ended" events. Finally, weirdly, the bounty icon on the answer itself only shows +100 instead of the actual award of +200. Effectively, I was able to award the same bounty twice to the same user by (unintentionally) exploiting a race condition.

Can there be some extra checking to make sure that the bounty isn't awarded twice, so that one can't intentionally exploit this race condition? Can we also delete extraneous bounty votes corresponding to when this race condition was exploited, both intentionally and unintentionally?

Update: With the help of rene, I found that, while this situation of a double-bounty is rare, it has occurred on occasion fairly often (around once a year on average for the past few years). In particular, this has occurred a total of nine times (four times on Stack Overflow, twice on Mathematics, and once each on Worldbuilding, Mi Yodeya, and Board & Card Games - that last one was my instance). There might be other instances where the same bounty was awarded to multiple answers (i.e. after nothing appeared to have happened on the first attempt, the bounty owner selected a different answer to award it), but as the system doesn't keep track of what bounty vote corresponds to what actual bounty, that can't be queried for.

I still think that the overarching bug should be fixed, as this might be exploitable by users, based on what happened with me and how my instance occurred. In the meantime, can we please at least delete these nine erroneous bounty votes, leaving these answers with just one bounty award?

Update 2: It appears that the extraneous bounty vote in this question has been manually removed; Cesar's reputation page now only lists one bounty award, and the answer's revision history only lists one award. However, weirdly, the tooltip on the answer still lists the two bounties (though the correct award is listed):

(Note that as I've deleted my account on the site in question, the bounty is retroactively attributed to the Community user.)

The other eight instances of double bounty awards still exist, though, but apparently there have been no new instances since.

Yesterday, I put a 100-rep bounty on an answer in order to give association bonus and network flair rights to our newly-appointed community manager, Cesar M.

While awarding the bounty, I clicked the button, then clicked OK on the dialog. The page refreshed, but nothing appeared to have happened. I tried again, clicked through the dialog, and it appeared as if the bounty was awarded.

I then saw something weird: my name was showing up twice on the bounty tooltip, despite my only having started one bounty. Also, Cesar's reputation page shows two separate +100 bounty gains within seconds, each corresponding to the same bounty, and the revision history of that answer shows two "bounty ended" events. Finally, weirdly, the bounty icon on the answer itself only shows +100 instead of the actual award of +200. Effectively, I was able to award the same bounty twice to the same user by (unintentionally) exploiting a race condition.

Can there be some extra checking to make sure that the bounty isn't awarded twice, so that one can't intentionally exploit this race condition? Can we also delete extraneous bounty votes corresponding to when this race condition was exploited, both intentionally and unintentionally?

Yesterday, I put a 100-rep bounty on an answer in order to give association bonus and network flair rights to our newly-appointed community manager, Cesar M.

While awarding the bounty, I clicked the button, then clicked OK on the dialog. The page refreshed, but nothing appeared to have happened. I tried again, clicked through the dialog, and it appeared as if the bounty was awarded.

I then saw something weird: my name was showing up twice on the bounty tooltip, despite my only having started one bounty. Also, Cesar's reputation page shows two separate +100 bounty gains within seconds, each corresponding to the same bounty, and the revision history of that answer shows two "bounty ended" events. Finally, weirdly, the bounty icon on the answer itself only shows +100 instead of the actual award of +200. Effectively, I was able to award the same bounty twice to the same user by (unintentionally) exploiting a race condition.

Can there be some extra checking to make sure that the bounty isn't awarded twice, so that one can't intentionally exploit this race condition? Can we also delete extraneous bounty votes corresponding to when this race condition was exploited, both intentionally and unintentionally?

Update: With the help of rene, I found that, while this situation of a double-bounty is rare, it has occurred on occasion fairly often (around once a year on average for the past few years). In particular, this has occurred a total of nine times (four times on Stack Overflow, twice on Mathematics, and once each on Worldbuilding, Mi Yodeya, and Board & Card Games - that last one was my instance). There might be other instances where the same bounty was awarded to multiple answers (i.e. after nothing appeared to have happened on the first attempt, the bounty owner selected a different answer to award it), but as the system doesn't keep track of what bounty vote corresponds to what actual bounty, that can't be queried for.

I still think that the overarching bug should be fixed, as this might be exploitable by users, based on what happened with me and how my instance occurred. In the meantime, can we please at least delete these nine erroneous bounty votes, leaving these answers with just one bounty award?