Logic bugs in checkout flows

Logic bugs pay bounties when authorization holds but business rules don't. Checkout flows are gold: price, quantity, coupons, and shipping interact — and the UI is rarely the source of truth.

Classic shapes

Negative quantity

owns: cart arithmetic

`-1` × price → creditinteger overflow on totals

Server must recompute totals; never trust client JSON.

Coupon stacking

owns: discount rules

apply expired code via replaystack incompatible promos via parameter pollution

State machine for discounts, not nested `if`s in one handler.

How to test safely

Capture the checkout API with two accounts. Replay with:

swapped product_id to a cheaper SKU while keeping displayed name metadata.
quantity: 0 or fractional values if the schema is loose.
race double-submit on payment intent creation.

Why this isn't IDOR

IDOR is "access someone else's object." Logic bugs are "access your own cart with rules the developer forgot." Both pay; the hunt looks different. See IDOR patterns for the other side.

Fix posture

Single pricing service (or function) used by cart, checkout, and receipts. Property tests on invariants: total ≥ 0, discounts ≤ subtotal, inventory non-negative.