auditing-payment-state-machine-and-idempotency

name	auditing-payment-state-machine-and-idempotency
description	Audit payment and checkout state machines for transitions an attacker can drive out of order or replay for value: an order marked paid before the charge is confirmed, a step that can be skipped or repeated so goods ship without settlement, a non-idempotent charge or fulfillment endpoint that double-processes on a retried or replayed request, and a refund or cancel that returns value while the underlying charge stays captured. Covers checkout, charge, fulfillment, and refund flows where money and goods change hands across a sequence of state transitions. Use when a purchase moves through ordered payment states and the transitions and their idempotency are the boundary. The out-of-order or replayed transition is the source, the value released without settlement is the sink, and the skippable step or non-idempotent handler that allows it is the bug.
license	MIT

Auditing payment state machine and idempotency: value must not move faster than settlement

A checkout is a state machine, and money moves through it in a strict order: an order is placed, a charge is authorized, the charge settles, and only then are goods fulfilled; refunds and cancels run the sequence backward. The bugs are transitions that break the order or repeat for value. An order marked paid before the charge is actually confirmed lets fulfillment run against a payment that never settles. A step that can be skipped, so fulfillment triggers without a completed charge, or repeated, so one payment yields multiple fulfillments, releases value the sequence did not authorize. A charge or fulfillment endpoint that is not idempotent double-processes when a request is retried or deliberately replayed, so a network retry or an attacker's repeat becomes two charges or two shipments. And a refund or cancel that returns value while the charge stays captured pays out twice. The audit walks the state machine and tries to move value ahead of, or more than once per, settlement. You audit this by driving transitions out of order and replaying the ones that release value.