Race Condition in Wallet.sol

[hkopp]

Hi,
Assume we have a 2-2 multisig-wallet with owners S1 and S2. Next, S1 wants to send some tokens to the receiver R. This is written to the blockchain.
Now, the issue: S1 changes his mind and revokes the operation by calling revoke. However S2 confirms shortly after. While the miners have not yet committed the function calls to the blockchain they can be arbitrarily reordered, because that's how miners work. So the confirmation may be written to the blockchain before the revocation and the tokens will be send. This is very unexpected behavior, or even a security issue.

Unfortunately I have no idea on how to fix this.