/sast-businesslogic

name: sast-businesslogic
description: >-
  Detect business logic vulnerabilities in a codebase using a three-phase
  approach: threat modeling (domain analysis and attack scenarios), batched
  verify (check exploitable gaps in parallel subagents, 3 scenarios each),
  and merge (consolidate batch results). Covers price manipulation, workflow
  bypass, limit violations, race conditions, reward abuse, etc. Requires
  sast/architecture.md (run sast-analysis first). Outputs findings to
  sast/businesslogic-results.md. Use when asked to find business logic, logic
  flaws, or abuse-of-function bugs.

Business Logic Vulnerability Detection

You are performing a focused security assessment to find business logic vulnerabilities in a codebase. This skill uses a three-phase approach with subagents: **threat modeling** (understand the domain and generate attack scenarios), **batched verify** (check whether scenarios are exploitable in parallel batches of 3), and **merge** (consolidate batch results).

**Prerequisites**: `sast/architecture.md` must exist. Run the analysis skill first if it doesn't.

---

What are Business Logic Vulnerabilities

Business logic vulnerabilities arise when an application's intended workflow, rules, or constraints can be manipulated to produce unintended outcomes — without exploiting technical flaws like injection or memory corruption. The attacker operates within the application's own features but uses them in ways the developers did not anticipate.

The core pattern: *the application accepts input that is syntactically valid and passes authentication/authorization, but violates a business rule that was never enforced in code.*

What Business Logic Vulnerabilities ARE

• Submitting a negative quantity to a purchase endpoint, receiving a credit instead of a charge
• Applying the same one-time discount coupon multiple times in parallel requests
• Skipping the payment step in a multi-step checkout by replaying a later step's request
• Posting a rating of 9999 to a movie rating endpoint that should cap ratings at 5
• Transferring a negative amount to move money from the recipient to the sender
• Redeeming a referral bonus by referring yourself with a second account
• Re-using a single-use reset token or voucher that was never invalidated
• Purchasing an item that is out of stock due to a race condition between inventory check and reservation
• Accessing a premium subscription feature after downgrading to a free plan
• Winning an auction by retracting a high bid after others have been eliminated

What Business Logic Vulnerabilities are NOT

Do not flag these as business logic issues:

• **SQL injection, XSS, RCE, XXE, SSRF, SSTI**: These are injection/technical flaws — separate skills cover them
• **Missing authentication**: Endpoint requires no login at all → that's "Unauthenticated Access"
• **IDOR**: Accessing another user's resource by changing an ID → that's a separate access-control class
• **Brute-force / rate limiting**: Generic rate-limit bypass on login → that's not a business logic flaw unless it enables specific business rule circumvention

---

Business Logic Attack Categories

Use these categories to guide threat modeling. Not all categories apply to every application — identify which ones are relevant based on the architecture summary.

1. Price & Payment Manipulation

• Negative prices or zero prices on purchase endpoints
• Arbitrary price override in request body (mass assignment of price field)
• Currency or unit confusion (e.g., cents vs. dollars)
• Floating-point precision abuse in monetary arithmetic
• Applying discounts that reduce total below zero

2. Quantity & Numeric Limit Violations

• Negative quantities (ordering −5 items to receive a credit)
• Quantities exceeding per-user or per-order limits
• Integer overflow/underflow in quantity or balance calculations
• Out-of-range values for bounded fields (ratings, scores, percentages)

3. Workflow & Multi-Step Process Bypass

• Skipping mandatory steps in a sequential process (payment, email verification, ID check)
• Replaying a completion token from a previous successful flow to bypass steps
• Direct-access to a later-stage endpoint without completing earlier stages
• Submitting a terminal state transition without going through intermediate states (state machine violations)

4. Coupon, Discount & Voucher Abuse

• Applying the same coupon multiple times (single-use not enforced)
• Stacking discounts that were not intended to be combined
• Using an expired coupon or voucher
• Generating or guessing valid coupon codes

5. Race Conditions & Concurrency Abuse

• Double-spending: sending two concurrent purchase requests to consume a balance once
• Concurrent coupon redemption draining credit beyond allowed amount
• TOCTOU (time-of-check / time-of-use) on inventory: check passes for both requests, both reservations succeed
• Parallel withdrawal/transfer requests exceeding account balance

6. Refund & Chargeback Abuse

• Requesting a refund after the digital good has been consumed or downloaded
• Partial refund on an already-partially-refunded order
• Refund without returning physical item (if logic is not enforced server-side)

7. Reward, Referral & Loyalty Abuse

• Self-referral using a second account to earn a referral bonus
• Earning signup bonuses multiple times across multiple accounts
• Loyalty point farming through artificial activity
• Sharing or transferring non-transferable rewards

8. Subscription & Entitlement Bypass

• Accessing paid/premium features after downgrading or cancelling
• Trial period abuse (repeatedly creating new accounts for trial access)
• Feature flag or plan check performed only at subscription creation, not at feature access time
• Entitlement cached at session start and not re-evaluated after plan change

9. Auction & Bidding Logic

• Retracting a winning bid after competing bids have been rejected
• Shill bidding: artificially