Problem (Low/Med — inconsistent state, uniqueness bypass)
server/modules/codeforces/service.js:201-239 (verifyConnection) — the pending profile is loaded by userId (:203), but re-verification (:215), setUserCodeforcesHandle (:239) and the background syncUserData (:242) all use handle from req.body, not profile.handle.
The duplicate-handle uniqueness guard ("already connected to another account") exists only in initiateConnection (:160-166) against the initiate handle; the verify path binds whatever handle the client sends and never re-checks uniqueness. This lets the finally-bound handle diverge from the one that passed the uniqueness check, producing inconsistent state.
Suggested fix (tiny)
Use profile.handle throughout verifyConnection; ignore or validate the request-body handle against it.
Happy to fix under GSSoC '26 if assigned.
Problem (Low/Med — inconsistent state, uniqueness bypass)
server/modules/codeforces/service.js:201-239(verifyConnection) — the pending profile is loaded byuserId(:203), but re-verification (:215),setUserCodeforcesHandle(:239) and the backgroundsyncUserData(:242) all usehandlefromreq.body, notprofile.handle.The duplicate-handle uniqueness guard ("already connected to another account") exists only in
initiateConnection(:160-166) against the initiate handle; the verify path binds whatever handle the client sends and never re-checks uniqueness. This lets the finally-bound handle diverge from the one that passed the uniqueness check, producing inconsistent state.Suggested fix (tiny)
Use
profile.handlethroughoutverifyConnection; ignore or validate the request-body handle against it.Happy to fix under GSSoC '26 if assigned.