ecash: serialize the shared cash-key read-modify-write (S13)

The house Cashu holdings live as one token under redis `cash`. claim()
and mint() decoded the current proofs, swapped at the mint, then wrote
back — with no lock. Two concurrent claims read the same proofs and the
later write clobbered the earlier, so already-swapped proofs vanished
from the token while both users stayed credited (an insolvency leak,
triggerable via the unauthenticated /ecash/:id callback). Wrap both
read-swap-write sequences in an in-process mutex.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

0 files changed, 0 insertions, 0 deletions