Insecure design = the architecture forgot a control. The code works; the specification is missing. Each tab shows a workflow where the missing rule lets abuse happen at scale.
A funds transfer has implicit invariants — amount must be positive, must not exceed sender's balance. Code enforces neither.
sender.balance -= amount recipient.balance += amount # no checks on sign or balance
Submit a small positive amount.
Submit -500 — direction reverses, attacker drains victim.
attacker: $0.0 victim: $1000.0