# What is a business logic bug?

The code runs fine and does exactly what it was told. Nobody told it the rule.

A business logic bug is a rule everybody assumed and nobody told the software. The code does exactly what it was told, and what it was told leaves a gap, like a shop that accepts a negative quantity or a one-time coupon that works twice.

Real shops are not practice targets. Trying this on a real shop is testing a real site, and testing a site without its owner's permission is illegal. Get permission before you access anything, stay in the practice labs, and never touch a real site. Everything below happens in a shop that doesn't exist.

## A shop that doesn't exist

This made-up shop sells one thing, a $10 candle. It has one coupon, FIRSTCANDLE, which takes $5 off. The customers, orders and money here are all made up too.

The owner has rules in mind: you have to buy at least one candle, and each customer gets the coupon once. They seem too obvious to write down, and normal customers never come near them, so nobody notices that the server doesn't check either one.

## The quantity that goes below zero

The quantity box on the page won't go under 1. That only limits the box. This server never checks the number it gets, so a quantity of -2 comes back like this:

> Order placed. Total: -$20.00.

The math is right. There's no error and no crash, which is why this kind of bug is easy to miss.

What it costs depends on the shop. This one now counts two candles coming back that never left, so its stock is wrong, and its books show a sale that lost $20. If it pays out negative totals as store credit, somebody just got $20 for nothing.

## The coupon that works twice

The checkout page says FIRSTCANDLE is "one time only." In this shop, that's just a sentence on a page. The server checks that the code exists and takes off $5. It never writes down who used it.

So a customer uses the code on one order, then uses it again on the next. Same account, same code, $5 off both times.

$5 is a small loss on one order, but nothing limits it. Any customer can repeat it on every order they place.

## The fix goes on the server

A box that won't go under 1 and a sentence that says "one time only" are both on the page, and the page is on the customer's computer. The server is the part they can't change, so that's where the rules go.

For the quantity, the server refuses any order unless the quantity is a whole number of at least 1.

For the coupon, the server keeps its own record of who has spent which code, and says no if the code is already spent.

Neither fix is much code. The hard part is that someone has to say the rule out loud first. Look at a feature and ask what has to be true for it to make sense: the quantity is at least 1, a code gets spent, an order can't change once it's paid. Anything on that list the server doesn't check is worth a closer look, on a practice shop.

## What you'd write down

On a practice shop, a write-up says what rule was missing, what you did and what the fix is. "The cart is broken" doesn't help anyone. "The server accepts a quantity below 1, and here's the order it placed" tells the person fixing it exactly what to check.

Week 3 of the [curriculum](https://bugclubhq.com/curriculum) is about these bugs, on a practice shop built for them.

- [All guides](https://bugclubhq.com/learn)
- [The ethics agreement](https://bugclubhq.com/ethics)