The Ravens store cart accepts several percentage coupons and adds their percentages with no cap, so once the sum passes 100% the total becomes zero or less.
A cart with a subtotal and a box for several comma-separated coupon codes. Percentage coupons add their percentages and the server caps nothing.
Drive the cart total to zero or below by stacking coupon codes.
You drove the total to zero or below.
Why the solution worked
The discount logic sums percentages without checking an upper bound, so passing 100% yields a discount larger than the price. Business logic must enforce its own rules: a minimum total, no stacking, and a discount cap.
The root cause
Summing discount percentages with no cap and no anti-stacking lets the total go negative. The root is missing business-logic constraints on discounts.
How the code is fixed
Cap the discount, forbid stacking, and never let the total fall below zero.
Vulnerable code
// Percentages are summed with no cap; the total can go negative.
const discount = codes.reduce((s, c) => s + COUPONS[c], 0);
const total = subtotal * (1 - discount / 100);
Safe code
// One coupon only, capped, and the total can never fall below zero.
const pct = Math.min(bestCoupon(codes), 100);
const total = Math.max(0, Math.round(subtotal * (1 - pct / 100)));
Impact in the real world
Discount-logic flaws grant free orders or credit and have cost real stores losses in coupon campaigns.
How defenders detect it
Defenders cap discounts, forbid stacking, reject any total below a floor, and alert on orders with an unusually high discount.
