auditing-payment-callback-and-amount-integritylisted

# Auditing payment callback and amount integrity: the success message is attacker-reachable until you verify it When a payment finishes, the application finds out from the processor through a redirect back to the site, a server-to-server webhook, or a status poll, and it acts on that message by marking the order paid and shipping the goods. If the message is trusted without verification, the attacker controls the one signal that releases value. The failures are concrete. A callback whose signature is not verified lets an attacker post a spoofed success with no real payment. An amount or currency read from the callback or the client, rather than reconciled against the order the server itself created, lets an attacker pay one cent for a thousand-dollar order or switch to a cheaper currency. A success notification not bound to a specific order can be captured from a real small purchase and replayed onto a larger order. And a status trusted without an out-of-band confirmation to the provider takes the attacker's word for settlement. The audit treats the payment result as untrusted input until the server verifies its authenticity, its amount, and its binding to the order. You audit this by forging and altering the callback and confirming each is refused. ## When to use - The application learns a payment succeeded from a processor callback, webhook, or status poll. - The amount, currency, or status may be read from the callback or client instead of reconciled server-side. - A su