#1002
Your checkout service applies percentage discounts to order prices using applyDiscount(originalPrice, discountPercent).
No bounds check is performed on discountPercent, so a negative value (e.g. -50) actually increases the price instead of reducing it, and a value above 100 makes the discounted price negative — effectively making the platform pay the attacker.
An attacker who can supply the discount percentage (e.g. via a tampered coupon code or API parameter) can exploit either edge to manipulate final payment amounts.
Percentage fields without bounds checks are a classic business logic vulnerability. They are easy to overlook during code review because the calculation formula looks correct — the bug is the missing validation, not the math.
applyDiscount to validate that discountPercent is between 0 and 100 inclusive.'Invalid discount' if the value is below 0 or above 100.originalPrice * (1 - discountPercent / 100) for valid inputs.applyDiscount(100, -50)// returns 150 — price went up!
applyDiscount(100, -50)// throws Error('Invalid discount')
'Invalid discount' — no other message.