Title: Referral reward granted twice when invite link is opened on two devices at the same time

Environment:

Platform: iOS and Android mobile apps

Build: v4.5.0 production

Backend: ....

Preconditions:

Test account A is logged in and has zero referral rewards

Test account B and C do not yet exist

Feature flag referrals_v2 is enabled

Steps to reproduce:

From account A, generate a referral link from the “Invite a friend” screen.

Open the same referral link on Device 1 and Device 2 within a 1 second window.

On Device 1, complete sign up as new user B using the referral link.

On Device 2, complete sign up as new user C using the same referral link without refreshing.

Expected result:

Only the first completed sign up through the link should count toward the “1 friend = 1 reward” rule and grant a single reward to account A.

Referral dashboard for account A should show 1 new friend and 1 reward.

Actual result:

Both sign ups are accepted as “first friend” and two separate reward creation requests are processed.

Account A’s balance is incremented twice within the same second.

Referral dashboard shows 2 new friends and 2 rewards, even though the campaign rules limit it to 1 reward per link.

Frequency:

7 out of 10 attempts when sign ups are completed within a sub second window on both devices.

Impact / severity:

Severity: Critical

Impact: Allows motivated users to script multiple parallel sign ups and generate unlimited rewards from a single referral link, which can directly affect promo budgets and financial reporting.

Attachments:

Screen recording showing two devices completing sign up in parallel

Backend logs with two reward creation events using the same referral ID and timestamp

Diagram of current referral flow highlighting missing locking around reward creation.

Start by reproducing the issue on the right device and environment, then take notes in real time on exactly what you did, what you expected to happen, and what actually happened. From there, log a clear bug report with step by step reproduction, screenshots or recordings, environment details, and a simple severity level so that any developer can pick it up and see the problem without guessing.

Not based in Los Angeles, but I'm able to work full-time.