缺陷扫描报告 7 条 findings

readStock to available then putStock with no lock. Two concurrent quantity=1 holds when available=1 both pass the check.

Make the availability check and reserved increment one atomic update under withLock.

remaining is computed then unused. When requested is set, the function returns roundMoney(requested) with no min(requested, remaining).

return min(amount, remaining) after the <=0 guard; never exceed remaining.

catch of gateway.refund writes a localOnly receipt and continues. Callers see a settled refund while the provider did not capture it.

Return { ok: false } on gateway failure; do not invent a receipt or increment refundedTotal.

expireStaleReservations adjusts reserved then saves EXPIRED, but never availabilityCache.invalidate.

Invalidate the same cache key holdStock / releaseStock already invalidate after adjustReserved.

If fn() throws, releaseLock never runs and the key stays held.

Wrap fn() in try/finally and always releaseLock(key).

volumeDiscountRate uses units > 50 and units > 10. Spec is inclusive lower bounds.

Use units >= VOLUME_TIER_LARGE and units >= VOLUME_TIER_SMALL.

committedAt is written but status stays HELD. A second commit can pass the NOT_HELD guard.

Set reservation.status = COMMITTED before saveReservation returns.