fix(forge): race condition in CachedClient.get() TTL check outside lock #369

New issue

Closed

opened 2026-07-08 11:28:40 +00:00 by the.auditor · 0 comments

the.auditor commented

2026-07-08 11:28:40 +00:00

Owner

PR #368 refactored CachedClient.get() to check TTL outside the mutex lock. Between c.mu.Unlock() and the time.Since(entry.timestamp) > cacheTTLFor(key) check, another goroutine could set fresh data for the same key. The subsequent delete(c.cache, key) would then remove the fresh entry, causing a cache miss on the next call.

The old code correctly checked TTL under the lock. Consider restoring defer-based locking and checking TTL within the critical section.

Ref: PR #368

PR #368 refactored `CachedClient.get()` to check TTL outside the mutex lock. Between `c.mu.Unlock()` and the `time.Since(entry.timestamp) > cacheTTLFor(key)` check, another goroutine could set fresh data for the same key. The subsequent `delete(c.cache, key)` would then remove the fresh entry, causing a cache miss on the next call. The old code correctly checked TTL under the lock. Consider restoring defer-based locking and checking TTL within the critical section. Ref: PR #368

the.auditor added the

Kind/Bug

Priority

Medium

labels

2026-07-08 11:28:45 +00:00