Tax amount is calculated on correct subtotal (pre-discount vs. post-discount)
Why it matters
Applying a 10% coupon discount after tax rather than before it systematically overcharges US customers. In most US states, sales tax is calculated on the post-discount price — applying tax first and then the discount is incorrect under standard US sales tax rules (CWE-682, ISO 25010:2011 functional correctness). A $100 cart with a $10 coupon should produce $90 × 0.085 = $7.65 tax; applying tax before discount produces $8.50 — a $0.85 overcharge per transaction that compounds across every discounted order. When the discount/tax order differs between cart preview and checkout confirmation, customers see a lower total in the cart and a higher total at payment, which triggers abandonment and disputes.
Severity rationale
Medium because per-order overcharges from incorrect operation order are small individually but accumulate across every discounted transaction and produce checkout total inconsistencies that customers recognize and flag.
Remediation
Enforce the correct US order of operations in lib/checkout.ts: subtract discount from subtotal before computing tax:
// lib/checkout.ts — correct US: tax after discount
function calculateOrderTotal(
items: OrderItem[],
discountCode: string | undefined,
address: Address
): OrderSummary {
const subtotal = items.reduce((sum, i) => sum + i.price * i.quantity, 0)
const discount = discountCode ? applyDiscount(subtotal, discountCode) : 0
const subtotalAfterDiscount = subtotal - discount
// Tax is computed on the post-discount taxable amount
const tax = calculateTax(items, address, subtotalAfterDiscount)
const shipping = calculateShipping(items, address)
const total = subtotalAfterDiscount + tax + shipping
return { subtotal, discount, tax, shipping, total }
}
Add a code comment citing the jurisdiction rule. If cart preview uses a separate path, consolidate both onto the same calculateOrderTotal function so the operation order is never divergent.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Shipping & Tax Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- cwe · CWE-682 — Incorrect Calculation
- iso-25010:2011 · functional-correctness — Functional Correctness (Functional Suitability)
- external · us-state-sales-tax-discount-timing — US state sales tax sourcing rules — tax applied to post-discount purchase price (e.g. California Revenue and Taxation Code §6011)
Taxons
History
- 2026-04-18·v1.0.0·Initial import from ecommerce-shipping-tax·automated