One of the first things you learn in software dev:
“Never trust any input from the client”
For some reason you didn’t validate in the frontend, and still didn’t validate in the backend. And you said there was proper testing.
Ragebait
In my early days as an inexperience fintech startup founder.
With proper testing we launched and we lost over a million Naira though we were able to recover it back via token charge.
This is how it happened…
User with 0 balance sent say -20 Naira to be withdrawn.
System read -20 as lesser than 0, so it did subtraction 0 - (-20) =20 (balance)
And then update user balance with 20 Naira.
From 0 balance to 20 Naira, in this case user can now withdraw 20 legitimately.
You see how an inexperienced developer building fintech can go to jail.