I Put 3 Bugs in This Pull Request. How Many Can You Catch?

说明与用途

PR 中的转账端点存在三大缺陷：未验证金额、使用 float 处理货币、并且余额更新缺乏并发安全性。

问题

A pull request introduces a money transfer endpoint with three critical bugs that could lead to incorrect balances, insecure handling of monetary values, and race conditions.

结果

Reviewing the PR would reveal three bugs: lack of amount validation, inappropriate use of float for money, and non‑concurrency‑safe balance updates.

工作流

• Validate that amount is positive and non‑zero.
• Replace float with Decimal or integer minor units for monetary amounts.
• Wrap balance check and update in a database transaction with row locking or an atomic conditional update to avoid race conditions.

证据

Nothing prevents: amount = -500

来源

float is being used for money

来源

The balance check and update aren't concurrency‑safe

来源