Support #12044
openSupport #12041: Issues in place order process and split rates flow
Premature Execution & Triple-Earning Exploit on Discounts / Loyalty
0%
Description
Location in Code:
payment.service.js:917-975
(persistPendingStripeOrder)
shop-controller.js:5200-5205
(Webhook Handler)
shop-controller.js:6208-6217
(Success Page Sync)
The Root Issue:
Premature Execution on Unpaid Orders: In
payment.service.js:964-974
, the function awardReferrerOnFirstPaidOrder is called before the customer ever enters their credit card details. If the customer closes the browser tab and never completes payment, the referring customer is already credited with real monetary rewards!
Triple Points Exploit:
Point earning (processLoyaltyEcomEarning) is called in persistPendingStripeOrder (Line 927).
If the customer arrives on the success page before the webhook, getOrderDetailsBySessionId calls processLoyaltyEcomEarning again (Line 6214).
When Stripe's webhook arrives a moment later, it runs completeExistingCardOrder and executes processLoyaltyEcomEarning a third time (Line 5203).
Impact: Customers can receive double or triple reward points on a single order, and referrers receive cash-value bonuses for abandoned checkouts.
Subtasks
Related issues
No data to display