Nonce race condition: marked after settlement

[a6b8]

Classification

• Blocker

Problem

Nonce is checked during validation (line 376-384) but only marked as "used" AFTER successful settlement broadcast (line 582-584). Two concurrent requests with the same nonce can both pass validation.

Affected Files

• src/v2/exact/evm/ServerExact.mjs lines 376-384 (validation) and 582-584 (markUsed)

Reproduction

1. Create a signed payment with nonce X
2. Send two identical requests simultaneously
3. Both pass validation, both attempt settlement

Expected vs Actual

• Expected: Only one request with the same nonce is accepted
• Actual: Race window between validation and settlement allows double-spend

Recommendation

Mark nonce immediately after successful validation (pessimistic locking). Optionally release on settlement failure with timeout.

Severity

CRITICAL