# Client-supplied order id not bound to package

Payment and order APIs trusting client-supplied order ids, quantities or totals instead of rebinding them server-side to the purchased item

_Area: Web business logic and race conditions. Seen in 4 disclosed reports; one confirmed bounty: $500; latest 2021-10-21. Updated 2026-10-23._

## How it works
A payment or order flow accepts an identifier or amount from the client (a provider order id, a line-item quantity, a total) and uses it to decide what is charged or delivered. The broken assumption is that the client-supplied value already corresponds to the item being bought. When the server never re-binds that value to the requested product or price, a value from a cheaper or different context is accepted for a more expensive one.

## Where it shows up
- Endpoints that take an `order_id`/`package_id` and later credit goods, where the amount is read from the id rather than the SKU [E1](https://bugbountylibrary.com/r/h1%3A1213765.md)
- Gift/transfer flows that issue a redeemable link or email as a side effect of a purchase call [E2](https://bugbountylibrary.com/r/h1%3A951230.md)
- Order submission APIs that accept client-computed line items, quantities or totals [E3](https://bugbountylibrary.com/r/h1%3A364843.md)
- Error responses on purchase endpoints that may still have produced side effects

## How to review
Check the invariant: the charged amount and delivered goods are derived server-side from the requested product, and any client-supplied id is validated to belong to that same product and price. For each purchase call, confirm the server recomputes totals from validated quantities (non-negative, bounded) rather than trusting the payload [E3](https://bugbountylibrary.com/r/h1%3A364843.md). For gift flows, confirm the redeemable token/email is only issued after payment authorization succeeds, and that a payment error rolls back all side effects [E2](https://bugbountylibrary.com/r/h1%3A951230.md). For provider order ids, confirm the server re-reads the amount from the provider and compares it to the requested package before crediting [E1](https://bugbountylibrary.com/r/h1%3A1213765.md).

## Variants seen
- Cross-linking a cheap pack's provider order id into a larger pack's purchase request [E1](https://bugbountylibrary.com/r/h1%3A1213765.md)
- Gift link emailed despite a payment-source error, yielding a free subscription [E2](https://bugbountylibrary.com/r/h1%3A951230.md)
- Negative-quantity line item lowering the order total [E3](https://bugbountylibrary.com/r/h1%3A364843.md)

## Impact and severity
Direct financial loss: paying $1.99 for a larger coin pack [E1](https://bugbountylibrary.com/r/h1%3A1213765.md), a free $25 membership [E2](https://bugbountylibrary.com/r/h1%3A951230.md), and underpaying order totals [E3](https://bugbountylibrary.com/r/h1%3A364843.md). Severity is high where the flow is repeatable and credits real goods; it worsens when error paths still deliver value and when no server-side recomputation exists.

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A1213765.md
- E2: https://bugbountylibrary.com/r/h1%3A951230.md
- E3: https://bugbountylibrary.com/r/h1%3A364843.md