Toctou

An idle/clicker TCP game whose shop checks affordability against a stale cached balance but deducts from a fresh re-read; racing two sessions as the same user underflows an unsigned long to ~1.8e19 bits and buys the flag.

A Flask meal-notification SSRF whose is_global filter is defeated by abusing urllib3’s retry-driven DNS re-resolution — a global IP that hangs on port 80 (8.8.8.8) outlasts dnsmasq’s 2s cache, so the retry re-resolves to 127.0.0.1 and reaches the localhost-only /vip-meal.