Is there a bug in the code or not?

Question

Laravel

Payment must be made, after a certain thing is transferred to the "player", the thing is sent, but the money is not withdrawn.

the code

public  function  Alm1(Request $request)
    {
    if(!Auth::check())
            return back()->withErrors('Необходимо авторизоваться, перед открытием магазина!');


       $account = Auth::user();
             $user1 = DB::connection('ddtank')->table('Sys_Users_Detail');
        $user = DB::connection('ddtank')->table('Sys_Users_Detail')->where('UserName', $account->name)->select('UserID', 'NickName', 'State', 'Money', 'GP')->get()->first();

        if($user->State == 1)
            return back()->withErrors("Необходимо выйти с игры прежде чем покупать вещи!");
if($user->Money < 2000000){
return back()->withErrors("Недостаточно алмазов");
}
$user->Money -= 250000;


  

        $alm = DB::connection('ddtank')->table('Sys_Users_Goods')->insertGetId(
            [
                'UserID' => 0,
                'BagType' => 0,
                'TemplateID' => 0,
                'Place' => -1,
                'Count' => 1,
                'Color' => "",
                'StrengthenLevel' => 0,
                'AttackCompose' => 0,
                'DefendCompose' => 0,
                'LuckCompose' => 0,
                'AgilityCompose' => 0,
                'IsBinds' => true,
                'IsUsed' => false,
                'BeginDate' => Carbon::now(),
                'ValidDate' => 0,
                'IsGold' => false,
                'goldValidDate' => 30,
                'latentEnergyCurStr' => "0,0,0,0",
                'latentEnergyNewStr' => "0,0,0,0",
                'latentEnergyEndTime' => Carbon::now(),
            ]
        );	
  
        try
        {


        DB::connection('ddtank')->table('User_Messages')->insert(
            [
                'SenderID' => 0,
                'Sender' => env('IM_SENDER', "Administration"),
                'ReceiverID' => $user->UserID,
                'Receiver' => $user->NickName,
                'Title' => "Покупка Магазина Алмазов",
                'Content' => "В игру были переведены купленные вещи из магазина алмазов!",
                'Type' => 52,
                'Remark' => "Gold:0,Money:0,Annex1:$alm,Annex2:,Annex3:,Annex4:,Annex5:,GiftToken:0",
                'Annex1' => "$alm",
                'Annex2' => "",
                'Annex3' => "",
                'Annex4' => "",
                'Annex5' => "",
            ]
        );

        $account->save();
        return back()->with('success', ['Вы успешно приобрели вещь!']);

      $user->save();
        }
        catch (\Exception $exception)
        {
            return back()->withErrors("Произошла ошибка, обратитесь к администратору!");
        }
    }

Answer 1

There are no errors in this code.
There are errors in the messages in Russian. In general, it is clear what the author meant, but he does not know the language, and writes with errors.
And there are no errors in the code.
For there to be an error, the code must have at least some sense, logic must be traced in it. And internal, from which it is clear what the author would like to do, and the logic of following programming techniques in the selected framework. And then it will be possible to detect an error in this logic.
But none of this is in the above code. It's just a mindless jumble of randomly jumbled operators. Well, it's like if you give a monkey chess, and then evaluate the position. What is the point of evaluating a chess study if some of the pieces are simply broken and the rest are lying under the table?
I understand that the author has dug up somewhere the code of the finished game, and, having no knowledge at all, is trying to remake something for himself.
I understand that the idea itself is not bad - everyone started that way.
But to look without bloody tears at this "code", at this rape of the framework - is basically impossible.

Answer 2

The piece of code is not the same.
You need to watch what user.save or account.save does. there is a write-off of the amount: but then it does not appear anywhere else, incl. in requests. Nothing more sensible "well, for some reason it's not being removed" until you get it, tk. there is no code responsible for saving the state or reacting to a change in the field of the user/account class. Oh yes, you write off the money, but in case of an error you do not return it back. Whatever you do in case of an error, the transaction must be rolled back and nothing written to the database. And you are neither here nor there. 50 people will write to you with support, you will get a headache for a couple of days, you will not cope, you will get an outflow of customers for a "divorce". the money was written off and the cheburashka was not sold.
$user->Money -= 250000;