[Security] addMemberToGroup has TOCTOU race condition on member count

[CrowdTypical]

Severity: LOW

Description

In lib/services/bill_service.dart, addMemberToGroup() checks the member count and then updates in two separate Firestore calls. Two simultaneous requests could both pass the check and exceed maxGroupMembers.

Recommendation

Either:

1. Use a Firestore transaction to atomically check-and-update
2. Or enforce the limit in Firestore security rules (already partially addressed — rules now enforce members.size() <= 2 on update)

The Firestore rule enforcement already mitigates this at the backend level. The client-side fix is optional but would provide better UX (prevent a failed write).

Files

• lib/services/bill_service.dart — addMemberToGroup() method