The Coupon That Stacked Itself — Java Bug Hunt

Briefing

Inspired by the promo-code exploits that make it to Twitter every Black Friday: enter SAVE10, then save10, then Save10 — and watch the discounts stack. Codes must apply once, case-insensitively.

Promotions.java applies a list of entered codes to a total.

Bug report

BUG-STACK10 · Priority: High (margin) · Reported by: e-commerce

applyCodes(totalCents, codes):

• each KNOWN code applies its percentage once, case-insensitive dedupe
• unknown codes are ignored
• discounts compound multiplicatively, integer cents floor at each step

Observed: "SAVE10" + "save10" gives 19%; script kiddies found it in hours.

Logs

[cart] codes=[SAVE10, save10, SAVE10] total 10000 -> 7290

The code as shipped

Promotions.java (editable)

import java.util.*;

class Promotions {
    static long applyCodes(long totalCents, String[] codes) {
        long total = totalCents;
        for (String code : codes) {
            Integer pct = PromoTable.PERCENT.get(code.toLowerCase());
            if (pct != null) {
                total = total * (100 - pct) / 100;
            }
        }
        return total;
    }
}

Read-only context: PromoTable.java.