Tax amount displayed in cart matches final checkout amount
Why it matters
When the cart page computes tax inline as subtotal * 0.085 while the checkout page calls getTaxAmount(), and the order creation API passes a different address to a third calculation, a customer who sees $8.50 in the cart arrives at checkout and sees $8.75 — a difference that reads as a pricing error and triggers abandonment or disputes. CWE-682 (Incorrect Calculation) applies when multiple call sites produce divergent values for the same input. ISO 25010:2011 functional correctness requires that the same cart contents and address produce the same tax amount at every display point. Inconsistency is especially damaging during the payment step: customers read the discrepancy as evidence the system is untrustworthy.
Severity rationale
High because tax amount discrepancies between cart and checkout are immediately visible to customers and create the impression of a bait-and-switch, driving abandonment at the payment step.
Remediation
Consolidate all tax display call sites onto a single getTaxAmount function in lib/tax.ts:
// lib/tax.ts — single source of truth, called from all pages
export function getTaxAmount(
items: OrderItem[],
address: Address,
customerIsExempt = false
): number {
if (customerIsExempt) return 0
const taxable = items
.filter(i => !i.is_tax_exempt)
.reduce((sum, i) => sum + i.price * i.quantity, 0)
const rate = getTaxRate(address)
return Math.round(taxable * rate)
}
// Usage on cart page:
const tax = getTaxAmount(cart.items, shippingAddress, user?.is_tax_exempt)
// Same call on checkout page:
const tax = getTaxAmount(cart.items, shippingAddress, user?.is_tax_exempt)
// Same call in order creation API route:
const tax = getTaxAmount(items, address, customer.is_tax_exempt)
Delete any inline subtotal * constant tax expressions scattered across component files and replace with this import. Confirm in a unit test that all three call sites return identical values for the same inputs.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Shipping & Tax Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- cwe · CWE-682 — Incorrect Calculation
- iso-25010:2011 · functional-correctness — Functional Correctness (Functional Suitability)
Taxons
History
- 2026-04-18·v1.0.0·Initial import from ecommerce-shipping-tax·automated