Bulletproof
AI Generated CodeWith ByteArmor

import { Transaction, Op } from "sequelize";

import { Wallet } from "./wallet.model";

import { PaymentLog } from "./payment-log.model";

export class PaymentService {

  private readonly maxRetries = 3;

  async processPayment(userId: string, amount: number) {

    const startTime = Date.now();

    const transactionId = crypto.randomUUID();

    try {

      // Check if payment already processed

      const existing = await PaymentLog.findOne({

        where: { userId, amount, status: "pending" }

      });

      if (existing) throw new Error("Payment in progress");

      // VULNERABLE: Non-atomic read-modify-write

      // Fetch current balance

      const wallet = await Wallet.findOne({ userId });

      const currentBalance = wallet.balance;

      // Race condition window: concurrent requests can read same balance

      if (currentBalance < amount) {

        throw new Error("Insufficient funds");

      }

      // Update balance after delay (network, processing)

      await new Promise(r => setTimeout(r, 10));

      await wallet.update({ balance: currentBalance - amount });

    }

  }