13

Yesterday, I put a 100-rep bounty on an answer in order to give association bonus and network flair rights to our newly-appointed community manager, Cesar M.

While awarding the bounty, I clicked the button, then clicked OK on the dialog. The page refreshed, but nothing appeared to have happened. I tried again, clicked through the dialog, and it appeared as if the bounty was awarded.

I then saw something weird: my name was showing up twice on the bounty tooltip, despite my only having started one bounty. Also, Cesar's reputation page shows two separate +100 bounty gains within seconds, each corresponding to the same bounty, and the revision history of that answer shows two "bounty ended" events. Effectively, I was able to award the same bounty twice to the same user by (unintentionally) exploiting a race condition.

Can there be some extra checking to make sure that the bounty isn't awarded twice, so that one can't intentionally exploit this race condition? Can we also delete extraneous bounty votes corresponding to when this race condition was exploited, both intentionally and unintentionally?

12

After further checking what happened, it appears that what you noticed is correct - it indeed counted twice for my rep (+200) whilst removing only 100 rep from you.

At this time I cannot explain what caused it to happen, but we will investigate further and I will edit this once we have more details.

Just wanted to clarify one thing: from your report, it's not clear what causes it to not show up the first time once the page was refreshed, so it isn't possible to 100% reproduce that every time, correct?

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .