#1003·mall

single coupon reusable via concurrent order submission

Author: YutuSecCreated Sep 15, 2026Updated Sep 15, 2026

The coupon-redemption flow does not enforce exclusive consumption of a coupon claim across concurrent order-creation requests. Although generateOrder is declared transactional, coupon availability is checked separately from the subsequent coupon-history update. The update identifies the record by primary key without requiring that its use_status remain 0.

During the concurrent test, five requests from the same member using couponId=32 returned successful order-creation responses with distinct order IDs 97–101. Each successful response showed two items with a per-unit coupon deduction of CNY 500.00, totaling CNY 1,000.00 per order.

The before-and-after database snapshots show coupon-history record 54 changing from use_status=0 to use_status=1, while record 55 remained unused. Five discounted orders were reported as successfully created, while only one displayed coupon-history record changed to the used state. These observations are consistent with a coupon-consumption race condition. The negative payable amounts observed in this test also involve the separately reported uncapped coupon-deduction issue.

Concurrent request Result
#1–#5 HTTP 200 "下单成功" → orders 97, 98, 99, 100, 101 — each persisted with coupon_amount=1000.00, pay_amount=-824.00
Coupon consumption records before/after:
history id use_status before
-- --
54 0
55 0