Fintech WORLD-00AF966D

Ivyhold Guild

Enterprise-grade fintech software for secure transaction processing and regulatory compliance. Serving mid-sized financial institutions with real-time data integration and risk management tools.

Two-Factor Authentication Prompt Loop

35 employees 3 engineering pillars 3 missions 1 injected bug

Employees

Pillars

Payment Processing Risk Management Data Analytics

Team

Personas

Every world includes realistic employee profiles with distinct personalities, communication styles, and roles.

Emily Johnson

Senior Developer

detail-oriented results-driven formal communicator

Michael Brown

Product Manager

innovative people-oriented collaborative

Sophia Davis

Finance Analyst

analytical confident clear communicator

Real Slack Data

Incident Thread

A production outage unfolds in real-time through the engineering Slack channel. Every world includes synthetic Slack conversations grounded in the injected bug.

# engineering Incident response · 15 messages

Michael Brown 09:14

uh... users are reporting they can't log in?

Sophia Davis 09:15

payment dashboard is blank for me too. related?

Emily Johnson 09:16

auth 500s spiked around 9:08

Michael Brown 09:17

wait the deploy was 8:30 right? thats suspicious

Emily Johnson 09:18

that was just a css change though

Sophia Davis 09:19

transfers are stalling on our side. do we roll back?

Emily Johnson 09:20

no stack traces. failures are silent somehow

Michael Brown 09:21

did the ssl cert expire?

Emily Johnson 09:23

certs fine, just checked

Michael Brown 09:24

new rate limiter then?

Emily Johnson 09:25

rate limiter would 429. not this

Sophia Davis 09:27

coffee machine on 3 is broken btw

Mission

Engineering Task

Each world includes 3 missions with acceptance criteria. Mission M-001 targets the injected bug directly.

Difficulty 3/5 Targets Bug

User 2FA Status Displays Incorrectly

After a recent update, admin users report that the two-factor authentication status for some users appears inconsistent. A user who has enabled 2FA may show as disabled, or vice versa. Internal investigation suggests a possible data translation error.

Acceptance Criteria

When a user has enabled two-factor authentication, their profile page shows 'Enabled' for 2FA.
When a user has disabled two-factor authentication, their profile page shows 'Disabled' for 2FA.
The admin panel user list reflects the correct 2FA status (Enabled/Disabled icon or text).
No regression: existing 2FA functionality (login flow) remains unaffected.

Architecture Decision

ADR-001: Database Field Mapping

Every world includes a realistic Architecture Decision Record documenting why and how technical choices were made.

Accepted ADR-001 · 2023-05-12

Context

The system needed to support multiple database backends (PostgreSQL and MySQL) with different naming conventions (camelCase vs snake_case). Hardcoding field names in business logic would reduce flexibility and increase maintenance effort when adding new backends or renaming columns.

Decision

Implement a centralized field mapping layer that translates application-level field names to database-specific column names via a JSON configuration file. The mapping is loaded at application startup and applied transparently in all data access operations.

Positive

Business logic remains database-agnostic
Renaming columns requires only config updates
Enables future schema migration without code changes

Negative

Mapping errors can cause silent data corruption
Config must stay in sync across environments
Runtime overhead from map lookups

Bug Injection

Vulnerable Code

Every world includes deliberately injected bugs in production code. AI agents must find, diagnose, and fix them — just like real incident response.

            fintech-backend/repos/fintech-backend/src/auth.js
            Bug Injected
          

const db = require('./db');

async function authenticate(req, res, next) {
  const userId = req.headers['x-user-id'];
  if (!userId) {
    return res.status(400).json({ error: 'Missing user ID' });
  }
  const user = await db.getUser(userId);  ← unhandled promise rejection
  req.user = user;
  next();
}
          

Bug: auth.js: authenticate function does not handle rejection from db.getUser, which rejects on second call due to counter in db.js, causing an unhandled promise rejection that fails silently.

            fintech-backend/repos/fintech-backend/src/db.js
            Root Cause
          

let counter = 0;

function getUser(id) {
  return new Promise((resolve, reject) => {
    setTimeout(() => {
      if (counter++ === 0) {
        resolve({ id: id, name: 'User' + id });
      } } else {          ← second call always fails
        reject(new Error('Database error: connection lost'));
      }
    }, 50);
  });
}
          

Resolution: Resolved the login loop that kept prompting 2FA-enabled users to re-enroll two-factor authentication, which had been blocking some folks from signing in. Existing 2FA configs are now being recognized properly at login.

Editions

From free samples to enterprise-wide deployment. All editions include full Commercial Training License.

Feature	Evaluation	Research	Professional	Enterprise
5 Preview Worlds	✓	✓	✓	✓
1,000 Worlds	—	✓	✓	✓
5,000 Worlds	—	—	✓	✓
Full 24,316 Worlds	—	—	—	✓
Commercial License	—	✓	✓	✓
QA Report	✓	✓	✓	✓
Dataset Updates	—	6 months	12 months	Ongoing
Priority Support	—	—	✓	✓

Evaluation

5 worlds · Evaluate quality before you commit.

5 enterprise worlds
Sample from all 10 domains
All 5 components per world
Unrestricted evaluation

Download Free Sample

Research

1,000 worlds · For individuals, universities, and startups.

1,000 enterprise worlds
All 10 domains represented
1,000+ RAG evaluation tasks
Full commercial training license
Documentation bundle

Request Quote

Professional

5,000 worlds · Built for commercial AI teams.

5,000 enterprise worlds
Stratified domain sampling
20,000+ RAG evaluation tasks
Full commercial training license
Priority support

Request Quote

Enterprise

Full dataset · For organizations requiring maximum coverage.

24,316 worlds (full dataset)
Maximized domain + difficulty coverage
97,290 RAG evaluation tasks
Full commercial training license
Custom domain weighting available
Dedicated support + onboarding

Request Quote