The Broken Exchange

Can you hack a financial ledger? Test concurrent double-spending, floating-point drift, and idempotency storms. Compare how naive backends fail versus how resilient systems protect transactional integrity.

Select Backend Architecture: Active: Naive CRUD Backend
[NAIVE MODE] Reads current balance, sleeps 60ms (simulating DB latency), then writes new balance. No row lock, no idempotency, single-column balance.
Simulated Accounts
LEDGER BALANCED
User Account (Alice) - Deposit Limit $1,000
$1,000.00
Bank Reserves
$50,000.00
Withdrawn Cash
$0.00
Trigger Exploit Vectors:
1. Race Condition Double-Spend
Fires 8 parallel $500 withdrawals via Promise.all() simultaneously.
2. Floating Point Salami Slicing
Executes 500 fractional $0.07 transfers prone to IEEE 754 precision drift.
3. Network Retry Storm
Simulates packet drop and rapid client 3x retry on a $300 transfer.
Live Transaction Stream 0 transactions
[00:00:00] System initialized. Ledger ready for simulation.
Zero-Sum Journal Entries (Double-Entry Audit) Assets = Liabilities + Equity
ID Timestamp Debit Account Credit Account Amount Status
#INIT Just now Bank Vault Reserves Alice Deposit Liability $1,000.00 POSTED

Why Financial Backends Must Be Built Differently

Standard CRUD web apps rely on simple database updates (UPDATE users SET balance = balance - 500). In high-frequency trading and fintech systems, this naive design leads to catastrophic financial loss.

1. Atomic Locking & Isolation

Without distributed locks or pessimistic DB row locks (SELECT FOR UPDATE), concurrent API requests read the exact same snapshot simultaneously, allowing users to spend the same dollar multiple times.

2. Zero IEEE 754 Floating-Points

Computers cannot represent decimal fractions like 0.1 accurately in binary (0.1 + 0.2 = 0.30000000000000004). Resilient financial systems store micro-units as integers (cents/micros) and enforce banker's rounding.

3. Idempotency Key Interceptors

Mobile networks drop packets frequently. When a mobile client auto-retries an API request, an AMQP/HTTP idempotency key guarantees the transaction executes exactly once, returning cached outcomes for duplicate attempts.

4. Double-Entry Invariants

Money never simply "increases" or "decreases"; it moves between accounts. Every transaction must contain equal debits and credits. If the system-wide sum is not exactly zero, all writes are halted immediately.

EA

Erlando Aubrey

Senior Backend & Distributed Systems Engineer

8+ years designing high-throughput trading platforms, event-driven architectures (AMQP/RabbitMQ), hybrid cloud/on-premise infrastructure, and mission-critical financial backends. Combines computer science with accounting foundations to build systems that never lose a cent.