I Put 3 Bugs in This Pull Request. How Many Can You Catch?

Description and use

The PR introduces a money transfer endpoint with three critical bugs: missing amount validation, using float for money, and lack of concurrency safety in balance updates.

Problem

A pull request introduces a money transfer endpoint with three critical bugs that could lead to incorrect balances, insecure handling of monetary values, and race conditions.

Outcome

Reviewing the PR would reveal three bugs: lack of amount validation, inappropriate use of float for money, and non‑concurrency‑safe balance updates.

Workflow

• Validate that amount is positive and non‑zero.
• Replace float with Decimal or integer minor units for monetary amounts.
• Wrap balance check and update in a database transaction with row locking or an atomic conditional update to avoid race conditions.

Evidence

Nothing prevents: amount = -500

Source

float is being used for money

Source

The balance check and update aren't concurrency‑safe

Source