isinstance(amount, (int, float)) is not a number check: NaN walks through a withdrawal guard

A walkthrough published on dev.to takes an ordinary Flask withdrawal endpoint, wraps it in three checks that look complete, and then empties it with a single request body of `{"amount": NaN}` ^[1][4]. The guards test type and magnitude, and none of them asks whether the value is a usable number, which is exactly the gap Python's own JSON parser hands them ^[5].

The endpoint holds a balance of 1000 in a module-level dict, parses the body with `json.loads`, rejects anything that is not a JSON object, and then applies three tests: `isinstance(amount, (int, float))`, `amount <= 0`, and `amount > STATE["balance"]` ^[1]. The stated intent is the obvious one: accept numeric amounts, allow only positive withdrawals, refuse anything larger than the balance ^[2]. On the happy path it behaves. 100 leaves 900, 0 comes back as "too small", 9999999 is rejected as greater than the balance, 900 takes the balance to 0, and a repeat 900 is refused ^[3].

Then the post sends `{"amount": NaN}` and gets "Success! New balance: nan" ^[4]. Python's native `json` parser accepts NaN, described in the post as one of the non-standard JSON constants, and converts it to `float("nan")` ^[5][8]. That object is a float, so the `isinstance` guard admits it ^[14]. The remaining two guards are comparisons, and since the request succeeded, neither `amount <= 0` nor `amount > balance` was true of the value ^[15].

Arithmetic does the rest. `1000 - nan`, `1000 + nan`, `nan * 0` and `nan - nan` all evaluate to nan ^[6]. The balance is now nan, and every subsequent withdrawal succeeds: the post follows the NaN request with 100 and then 1000, both returning "Success! New balance: nan" ^[7]. That is 1100 withdrawn against a starting balance of 1000 with no guard tripped ^[16].

Persisting the value changes the failure mode rather than containing it. In the SQLite variant the balance is a REAL column seeded at 1000; a withdrawal of 123 writes 877.0, and the NaN withdrawal writes NULL ^[9][10]. The author's summary is that the balance is broken from then on and cannot be operated on ^[11]. Postgres, according to the same post, stores NaN as an actual numeric value, corrupting the balance in a different way ^[12].

The transferable point is the shape of the check rather than the specific constant. `isinstance` answers a question about the object's type, and float("nan") is a float ^[14]. Because nan propagates through arithmetic ^[6] and does not compare true against a threshold ^[15], no combination of a type test and relative magnitude tests can exclude it; the guard has to assert finiteness before the value reaches the subtraction ^[17]. Two things worth an audit in your own services: every path where a numeric field from `json.loads` is subtracted, compared or written to a column, and what your specific database does with a non-finite float, since SQLite and Postgres in this post diverge ^[10][12]. Note also that the source material available here cuts off mid-command after the SQLite NULL, so the Postgres behaviour is asserted by the author rather than shown ^[12].