I Put 3 Bugs in This Pull Request. How Many Can You Catch?

Описание и применение

В PR добавлен эндпоинт перевода средств, содержащий три критические ошибки: отсутствие проверки суммы, использование float для денег и отсутствие защиты от гонок при обновлении баланса.

Задача

A pull request introduces a money transfer endpoint with three critical bugs that could lead to incorrect balances, insecure handling of monetary values, and race conditions.

Результат

Reviewing the PR would reveal three bugs: lack of amount validation, inappropriate use of float for money, and non‑concurrency‑safe balance updates.

Рабочий процесс

• Validate that amount is positive and non‑zero.
• Replace float with Decimal or integer minor units for monetary amounts.
• Wrap balance check and update in a database transaction with row locking or an atomic conditional update to avoid race conditions.

Доказательства

Nothing prevents: amount = -500

Источник

float is being used for money

Источник

The balance check and update aren't concurrency‑safe

Источник