#1003
Your checkout service allows customers to apply multiple discount codes to an order, each reducing the price by a set percentage.
The applyDiscountCodes function applies all supplied codes additively without checking whether the combined discount exceeds 100%, allowing an attacker to stack codes until the order total becomes zero or negative.
By submitting a carefully chosen set of duplicate or complementary codes, an attacker can obtain products for free or force the platform into a negative-balance transaction.
Coupon stacking attacks are regularly used to obtain goods for free on e-commerce platforms. A missing aggregate check is all an attacker needs — even if each individual code is perfectly valid.
applyDiscountCodes to sum all applicable discounts and validate the total before applying.'Discount stack limit exceeded' if the combined discount percentage is greater than 100.price * (1 - totalDiscount / 100) for valid discount combinations.applyDiscountCodes(100, ['SAVE70','SAVE70'], validCodes)// returns -40 — price went negative!
applyDiscountCodes(100, ['SAVE70','SAVE70'], validCodes)// throws Error('Discount stack limit exceeded')
'Discount stack limit exceeded' — no other message.