Progress
0 / 6 logic rules broken this session.
The method that finds all of these: map the workflow, list the assumptions each step makes about price / quantity / coupon / order / idempotency, then break each one. Client validation is UX; the server is the only control that counts.
⬜ Naked -- Price tampering: server trusted a client-supplied price
⬜ Naked -- Negative quantity: a negative line total credited the wallet
⬜ Naked -- Coupon reuse: a single-use coupon was applied repeatedly
⬜ Naked -- Workflow bypass: order confirmed without the payment step
⬜ Naked -- Replay / idempotency: one refund request credited more than once
⬜ Methodology -- Afford the unaffordable: chained two flaws to acquire the objective item