Shipping rates are calculated accurately based on weight, distance, or method
Why it matters
A flat shipping rate applied to every order regardless of weight, destination, or carrier method is a CWE-682 (Incorrect Calculation) defect that costs money in both directions: the store eats losses on heavy or long-distance shipments, or overcharges customers on lightweight local orders — which triggers chargebacks and cart abandonment. ISO 25010:2011 functional correctness requires that computed outputs match business rules. When every order is charged the same $5.00 regardless of a 50 lb appliance vs. a greeting card, the store is either subsidizing shipping losses or alienating customers who see inflated charges and leave.
Severity rationale
Critical because a flat-rate-for-all calculation directly produces financial losses on heavy shipments or overcharges that drive customer disputes and abandonment.
Remediation
Implement dynamic shipping calculation in lib/shipping.ts that uses at least 2 of 4 factors — weight, destination zone, method, or carrier API:
// lib/shipping.ts
async function calculateShippingCost(
items: OrderItem[],
destination: Address,
method: ShippingMethod
): Promise<number> {
const totalWeight = items.reduce((sum, item) => sum + item.weight * item.quantity, 0)
if (method === 'carrier') {
const shipment = await easypost.shipment.create({
from_address: { city: ORIGIN_CITY, state: ORIGIN_STATE },
to_address: { city: destination.city, state: destination.state },
parcel: { weight: totalWeight },
})
return Number(shipment.rates[0].rate) * 100 // convert to cents
}
const base = getBaseRate(destination.state)
const weightSurcharge = Math.ceil(totalWeight / 5) * 50 // 50¢ per 5 lbs
return base + weightSurcharge
}
Delete any hardcoded constant returned from a calculateShipping function and replace with this parameterised implementation.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Shipping & Tax Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- cwe · CWE-682 — Incorrect Calculation
- iso-25010:2011 · functional-correctness — Functional Correctness (Functional Suitability)
Taxons
History
- 2026-04-18·v1.0.0·Initial import from ecommerce-shipping-tax·automated