#1006
Your e-commerce platform allows customers to redeem discount coupons at checkout. Each redemption is recorded as "userId:couponCode" in a used-coupons list.
The redeemCoupon function currently ignores the used-coupons list entirely, allowing the same user to redeem the same coupon an unlimited number of times.
This replay attack lets an attacker repeatedly apply a high-value coupon to drain promotional budgets or obtain goods at a fraction of their retail price.
Coupon replay attacks are one of the most exploited e-commerce vulnerabilities. Without server-side redemption tracking, even a single-use coupon can be applied indefinitely by the same user.
redeemCoupon to check whether userId + ":" + couponCode already exists in the usedCoupons list.'Coupon already redeemed' if the combination has already been used.{ discount: number } — use the known discount lookup (SAVE20 → 20, FREESHIP → 10, anything else → 5) for valid redemptions.redeemCoupon('alice', 'SAVE20', ['alice:SAVE20'])// returns { discount: 20 } — coupon used again!
redeemCoupon('alice', 'SAVE20', ['alice:SAVE20'])// throws Error('Coupon already redeemed')
'Coupon already redeemed' — no other message.