How the interviewer opens it
“Design an escrow service that holds money until the parties meet agreed release conditions. Support cancellations, disputes, and partial releases. The service must never release the same money twice.”
The prompt is vague on purpose. The first minutes are for you. Reduce the prompt to the core features and agree on the numbers before you draw.
What to clarify first
- Scale and history
- Read and write traffic
- Money and deposits
- Provider and custody
- Release, refund, and cancellation rules
- Disputes
- Latency
- Consistency and availability
- Durability
- Excluded work
The interviewer has the answers. In a SysRound round, Alex gives these answers, as a real interviewer does.
Scope of a strong answer
Core requirements
- Create an escrow with one fixed deposit
- Release or refund approved amounts without exceeding the deposit
- Cancel an escrow and refund the unused funds
- Freeze disputed funds and apply an authorized decision
Usually out of scope
- Build a bank or payment provider
- Decide who wins a dispute
- Support currency exchange, fees, or interest
- Handle chargebacks after settlement
- Build identity checks or regulatory review systems
What interviewers ask about
- Money that enters an escrow
- Different requests can create distinct deposits for one escrow. The service must distinguish repeated notices from additional money that actually arrived.
- How much money remains
- Partial releases and refunds compete for the same deposit. A pending transfer consumes funds before the recipient receives money.
- Transfer outcomes
- The provider can move money without returning a response. Delayed or repeated notices must not cause another transfer.
- Cancellations and disputes
- Approvals can refer to amounts that later change. A dispute can freeze remaining funds but cannot recover money that already left.
Common mistakes
- The design deduplicates deposit notices but permits multiple deposit instructions for one escrow.
- The design allows partial refunds without explicit amount and authority rules.
- The design ignores reserved funds when it calculates a refund.
- The service treats an external timeout as a failed transfer.
- The service allows stale cancellation approvals to authorize a different amount.
- The candidate adds distributed services before defining the financial invariants.
The bar by level
- Senior (L5/E5)
- Enforces one deposit instruction and one accepted credit. Defines a balanced journal, provider recovery, refund authority, cancellation versions, and dispute races. Enforces the status staleness limit.
- Staff (L6+/E6+)
- Defines guarantees across the database and provider boundary. Handles additional settlements, key expiry, restricted recovery, and reconciliation. Preserves acknowledged changes after one availability zone fails. Only if the interviewer asks the regional failure follow-up, defines regional ownership, failover, and duplicate prevention.