This is a pretty standard type of transaction. By far, the most important thing is that you perform the entire transaction on the server, not on the client; you cannot trust the client. To make things work nicely for an end-user, you can run these transactions on the client, but they cannot be definitive until the server has verified them.
Also, make sure you perform the whole thing in a database transaction. If you subtract 10 points from User A, then fail to add them to User B for some reason, User A would be pretty angry if they didn't get their 10 points back; it's even worse if it happens in the other direction, as users can game the system to generate free points.
One thing you may or may not be concerned about are replay attacks. Imagine that you are on my network and I MitM your connection to the server while you make a transaction to give me 10 points; then, I later resend that same HTTP request several more times to drain your account. There are a few different countermeasures you can take, but you should be able to lean on TLS to prevent this.
Which reminds me, absolutely all of your traffic that sends a session (or arguably, all traffic period) should go over HTTPS. This prevents a number of issues, like the above and session hijacking attacks. You did mention this already, but I figured I should re-iterate it.