From 013a49a1c6d8373c8105f1fba04e2c783967e116 Mon Sep 17 00:00:00 2001
From: maxx-GENIUS <maxx-GENIUS@users.noreply.github.com>
Date: Sat, 10 Oct 2026 18:02:46 -0700
Subject: [PATCH] fix(auth): make nonce verification and consumption atomic

---
 src/auth/nonce.service.ts | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)
 create mode 100644 src/auth/nonce.service.ts

diff --git a/src/auth/nonce.service.ts b/src/auth/nonce.service.ts
new file mode 100644
index 0000000..e7f7512
--- /dev/null
+++ b/src/auth/nonce.service.ts
@@ -0,0 +1,16 @@
+import { Redis } from 'ioredis';
+
+export class NonceService {
+  constructor(private redis: Redis) {}
+
+  /**
+   * Atomically verifies and burns authentication nonce in a single operation.
+   * Eliminates TOCTOU race conditions under concurrent authentication requests.
+   */
+  async consumeNonce(walletAddress: string, clientNonce: string): Promise<boolean> {
+    const key = uth:nonce:;
+    // Atomic GETDEL prevents duplicate concurrent read-before-delete
+    const storedNonce = await this.redis.call('GETDEL', key);
+    return storedNonce === clientNonce;
+  }
+}
\ No newline at end of file