← back to room
Business Logic

Checkout Logic Bugs

Scenario

Coupons like SAVE50 should apply only once per checkout session. The server never tracks whether a code was already used on the same cart. Stack the same discount twice on one order.

Your approach

  1. Start checkout with a single valid coupon applied.
  2. Apply the same coupon code again through the API or form.
  3. Confirm the total drops further than a single use allows.
  4. Read the coupon reuse flag on success.
  5. Submit that flag.
The checkout form posts price, qty, and coupon. Tamper them. Coupon code: SAVE50.

Pro hoodie — $49.99

Hint: edit the hidden price field (DevTools) or set qty negative.