Recommended Free Tools
Can you spot what’s wrong with code someone else wrote? Review the endpoint below before reading the explanations. If this were a real pull request, what would you flag before approving it?
Review the code first
The example is a simplified Python-style money-transfer endpoint. Try to identify three defects before scrolling to the findings.
As an Amazon Associate I earn from qualifying purchases.
def transfer(sender, receiver, amount: float):
if sender.balance < amount:
raise ValueError("Insufficient funds")
sender.balance -= amount
receiver.balance += amount
Ask yourself: what inputs should be allowed, what kind of number should represent money, and what could happen if two requests run at the same time?
Bug 1: The amount is not validated
The code checks whether the sender has enough money, but it never requires the amount to be positive. A zero-value transfer is accepted, and a negative amount reverses the arithmetic: subtracting a negative number increases the sender’s balance, while adding it decreases the receiver’s.
#1 Best Overall
Define the transfer’s input constraints explicitly and enforce them before changing either balance. For example, an application might require an amount greater than zero and impose a currency-specific precision rule. The exact constraints depend on the application; this snippet does not specify them.
Bug 2: A float is a poor default for money
The parameter is annotated as float. Binary floating-point cannot represent some decimal fractions exactly, so calculations can produce small precision differences. Python’s Python 3.11.17 Decimal documentation explains that values such as 1.1 and 2.2 do not have exact binary float representations, while Decimal supports exact decimal representation and configurable rounding.
Common alternatives include Decimal or integer minor units, such as cents. Neither choice defines the currency, permitted scale, input parsing, or rounding policy by itself; the application must specify those and keep the database representation consistent. Replacing float alone does not make a payment flow safe.
Bug 3: The balance check and updates can race
The endpoint reads the sender’s balance, checks it, and then updates two balances. If two requests run concurrently, both could read the same balance and both pass the check. Their combined transfers may then overdraw the sender.
Rank #3
Use a strategy appropriate to the database to make the check and both updates safe against competing requests. In PostgreSQL, row-level locking includes SELECT FOR UPDATE, which locks selected rows against competing updates until the transaction ends. This is one database-specific mechanism, not a universal prescription. When locking both accounts, the implementation must also consider consistent lock ordering and how it handles deadlocks.
A transaction wrapper by itself is not a guarantee: the safety of a read-check-write sequence depends on the database and isolation level, as well as the concrete locking or conflict-handling strategy.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What to take into the next review
- Check that invalid amounts are rejected before any balance changes.
- Look for a money representation and rounding policy that match the currency and storage layer.
- Trace concurrent requests through the balance check and both account updates; verify how the chosen database strategy prevents conflicting transfers.
The original challenge and its three planted findings appeared in Anas Bahraoui’s DEV Community article, published October 2, 2026. It also describes ReviewIQ as a place to practice reviewing planted-bug examples. The article states that its first five reviews are free and do not require a card; those are the article’s offer terms, not independently verified current terms.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
