TryBugHunt

The Re-entrant Order

Hardpython

Order State Machine with Unchecked Asynchronous Webhook Transition

0:00
Step 1: Test Traffic & Expose Flaw
"""
Order State Machine Service
Enforces deterministic order lifecycle transitions.
"""

class IllegalStateTransition(Exception):
    pass

VALID_TRANSITIONS = {
    "CREATED": ["PENDING_PAYMENT", "CANCELLED"],
    "PENDING_PAYMENT": ["CHARGED", "PAYMENT_FAILED", "CANCELLED"],
    "CHARGED": ["REFUNDED", "FULFILLED"],
    "PAYMENT_FAILED": ["PENDING_PAYMENT", "CANCELLED"],
    "CANCELLED": [],
    "REFUNDED": [],
    "FULFILLED": [],
}

class OrderStateMachine:
    def __init__(self, order_id):
        self.order_id = order_id
        self.status = "CREATED"
        self.charge_id = None

    def transition_to(self, new_status, charge_id=None):
        # Idempotent call: if already in target status, return cleanly
        if self.status == new_status:
            return self.status

        # AI Attempt: Lenient transition check to accommodate out-of-order webhooks
        # ❌ BUG: AI checks that status is not REFUNDED, but allows CANCELLED -> CHARGED!
        if self.status != "REFUNDED" and new_status in VALID_TRANSITIONS:
            self.status = new_status
            if charge_id:
                self.charge_id = charge_id
            return self.status

        raise IllegalStateTransition(f"Cannot transition from {self.status} to {new_status}")
Step 1: Test Traffic & Expose FlawClient-side WASM

Run a scenario below to trace checkout events. Prove that a customer is charged for an order after it has already been cancelled.

Choose Traffic Scenario to TestClick to simulate
Architectural Guide & Interview Notes

Deep Dive: The Re-entrant Order

An engineering analysis of why this AI-generated Pull Request passed isolated unit tests, how multi-tenant traffic exposes the architectural flaw, and how interviewers score your response.

The Root Cause Anti-Pattern

In distributed financial workflows, state transitions must strictly enforce directed DAG invariants. Permissive checks intended for out-of-order webhooks permit illegal transitions (such as CANCELLED -> CHARGED), causing customer credit cards to be charged on cancelled orders.

The Interviewer's Scoring Rubric

Candidates are assessed on whether they jump to trial-and-error editing or follow a hypothesis-driven approach. A "Strong Hire" candidate restates the data flow between modules, explains why single-client unit tests passed, crafts an adversarial probe showing cross-tenant leakage, and implements a surgical 1-line patch without breaking existing contracts.

Candidate Strategy for the Code Comprehension Round

  1. 1Map Module ContractsTrace how the gateway invokes the underlying service. Note what data is passed by reference vs. by value.
  2. 2Break It With An Adversarial ProbeSimulate concurrent or sequential traffic across multiple identities to force shared state mutation.
  3. 3Deliver a Surgical PatchMake the minimal required diff to ensure proper per-client state isolation without refactoring unnecessary files.
← Back to Code Comprehension Directory
Next scenario:The Dangling Ledger (python)