# Client-trusted payment success and status mapping

Server crediting goods, wallet, or points from client amount, status string, return URL, or premature order status

_Area: Web business logic and race conditions. Seen in 6 disclosed reports; 2 confirmed bounties: $531 and $2,000; latest 2026-09-24. Updated 2026-10-23._

## How it works

The server must learn "money settled" only from a channel the client cannot forge: a signed provider callback or a server-initiated provider query. The broken assumption is that some value reaching the merchant is authentic proof of settlement bound to the order the server created. That value can be a client-supplied amount, a status string the client posts back, a return URL, or an order status the server itself sets too early. When the merchant credits goods, balance, or points from that value, the attacker supplies the proof instead of the payment network [E1](https://bugbountylibrary.com/r/h1%3A1408782.md)[E2](https://bugbountylibrary.com/r/blog%3Acrypt0g30rgy-github-io-post-paymentbypasstwo.md)[E3](https://bugbountylibrary.com/r/h1%3A592803.md)[E4](https://bugbountylibrary.com/r/blog%3Acrypt0g30rgy-github-io-post-paymentbypassthree.md).

## Where it shows up

- Two-step order-then-pay flows where the pay step accepts amount, currency, or order_id from the request [E1](https://bugbountylibrary.com/r/h1%3A1408782.md)
- Checkout JS branching on a response string like "Authorised"/"Refused" and posting that same value to a fulfillment endpoint [E2](https://bugbountylibrary.com/r/blog%3Acrypt0g30rgy-github-io-post-paymentbypasstwo.md)
- Provider success/return URL appearing in client-visible status JSON, with the merchant redirecting to it instead of verifying via webhook [E4](https://bugbountylibrary.com/r/blog%3Acrypt0g30rgy-github-io-post-paymentbypassthree.md)
- Rewards/entitlement code keyed off an order status that a gateway (COD, bank transfer, cheque) sets before payment [E3](https://bugbountylibrary.com/r/h1%3A592803.md)

## How to review

State the invariant: the amount credited and goods released are derived server-side from the stored order record, and settlement is confirmed by a signed server-to-server callback or server-initiated provider query. Then check:

- Fulfillment/credit endpoints ignore client amount, status strings, and order_id for pricing; the server re-reads the stored amount and product and rejects mismatches [E1](https://bugbountylibrary.com/r/h1%3A1408782.md)
- The fulfillment endpoint re-derives success itself rather than trusting a status value the client posts back [E2](https://bugbountylibrary.com/r/blog%3Acrypt0g30rgy-github-io-post-paymentbypasstwo.md)
- The return URL is never the sole success signal; a webhook or provider query confirms settlement [E4](https://bugbountylibrary.com/r/blog%3Acrypt0g30rgy-github-io-post-paymentbypassthree.md)
- Entitlement code checks that the status transition implies actual payment, enumerating gateways that set it early [E3](https://bugbountylibrary.com/r/h1%3A592803.md)

## Variants seen

- Client-supplied amount not reconciled against stored order amount, crediting wallet up to 10K INR [E1](https://bugbountylibrary.com/r/h1%3A1408782.md)
- Response-body status string trusted, flipped from Refused to Authorised to obtain giftcards [E2](https://bugbountylibrary.com/r/blog%3Acrypt0g30rgy-github-io-post-paymentbypasstwo.md)
- Points awarded on "processing" status that COD sets before payment, enabling unlimited farming [E3](https://bugbountylibrary.com/r/h1%3A592803.md)
- Return URL from status JSON trusted to mark unpaid orders paid [E4](https://bugbountylibrary.com/r/blog%3Acrypt0g30rgy-github-io-post-paymentbypassthree.md)

## Why fixes fail

E2 and E4 come from the same write-up series, suggesting a point fix on one endpoint left a sibling trust path open. Fix the class, not the endpoint.

## Impact and severity

Direct financial loss: free or discounted goods, wallet credit, giftcards, farmable points. Severity rises where credit is cashable or repeatable at scale and where the same trust flaw spans multiple endpoints.

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A1408782.md
- E2: https://bugbountylibrary.com/r/blog%3Acrypt0g30rgy-github-io-post-paymentbypasstwo.md
- E3: https://bugbountylibrary.com/r/h1%3A592803.md
- E4: https://bugbountylibrary.com/r/blog%3Acrypt0g30rgy-github-io-post-paymentbypassthree.md