Docs: expireAccount() TOCTOU race window postmortem

[deedee-code]

Executive Summary

Adds a standalone lessons-learned article documenting the check-then-call (TOCTOU) race window in expireAccount(), why it is likely low-risk given on-chain expire() idempotency, and why “probably fine because X” assumptions should be recorded explicitly.

Linked Issues & References

• Closes: [FAQ entry] bridgelet-product-audit/faq/is-there-a-login-session.md: Is there a login session or account system for senders? #335

Type of Change

Category

• New Feature (Non-breaking change adding functionality)
• Bug Fix (Non-breaking change fixing an issue)
• Performance Optimization (Code change to improve efficiency)
• Refactoring (Code structure change without external API modification)
• Security Patch (Fixing a vulnerability or security concern)
• Documentation (Updates to README, Wiki, or inline docs)
• Infrastructure (CI/CD, build scripts, Docker)

Domain

• Smart Contracts (Rust/Soroban)
• SDK/Backend (NestJS/TypeScript)
• Frontend/UI

Technical Implementation Details

• New folder: bridgelet-sdk-audit/postmortems/
• New article: expire-account-race-window.md
• Covers general TOCTOU, this specific race, residual risk caveats, and documenting implicit safety assumptions
• Documentation-only; no changes to src/, test/, apps/, or libs/

Breaking Changes

• No - Backward compatibility is maintained.
• Yes - This change requires consumers of the SDK/Contract to update their code.

Verification & Testing Strategy

Automated Tests

• Unit Tests: Added/Updated new unit tests.
• Integration Tests: Verified interaction between modules.
• Linting: Code follows the project's style guide.

Manual Verification

1. Environment:

• Target Environment: N/A (docs-only)

2. Reproduction Steps:

1. Open bridgelet-sdk-audit/postmortems/expire-account-race-window.md
2. Confirm TOCTOU explanation, low-risk reasoning, and closing lesson are present
3. Confirm no application/source code paths were modified

3. Proof of Execution:
Article rendered/readable in the PR diff; working tree contains only the new markdown file.

Quality Assurance Checklist

• I have performed a self-review of my own code.
• I have commented on my code, particularly in hard-to-understand areas.
• I have updated the documentation to reflect these changes.
• My changes do not generate new warnings or errors.
• I have verified that new dependencies are necessary and secure.
• (If Smart Contract) I have verified gas usage and storage footprints are optimized.

[vercel]

@deedee-code is attempting to deploy a commit to the aminubabafatima8-gmailcom's projects Team on Vercel.

A member of the Team first needs to authorize it.