Custom E-Commerce Architecture in India: Scaling High-Concurrency Flash Sales & Defending Against Scalper Bots

Building high-scale e-commerce platforms in India requires navigating intense traffic spikes, complex payment ecosystems (UPI, Cash on Delivery with OTP verification), integration with national digital commerce networks like ONDC (Open Network for Digital Commerce), and aggressive automated bot attacks during flash sale launches.

Relying on generic e-commerce platforms (such as off-the-shelf Shopify or WooCommerce) frequently leads to catastrophic database deadlocks when 50,000 customers attempt to purchase 1,000 inventory items in a 10-second flash sale window.

In this technical paper, Cyberfact Security presents the production architecture required to build custom, high-concurrency e-commerce platforms capable of handling over 25,000 transactions per second (TPS) while neutralizing scalper bot syndicates.

1. The High-Concurrency Inventory Challenge

During high-demand flash sales, traditional relational database updates fail:

-- DANGEROUS: Classic row update causes massive row-lock contention and deadlocks
UPDATE inventory SET quantity = quantity - 1 WHERE product_id = 'PROD-9812' AND quantity > 0;

When 10,000 concurrent database connections execute this query simultaneously, the database thread pool collapses, CPU utilization hits 100%, and transactions timeout.

The Decoupled Inventory Architecture:

[ Incoming Purchase Traffic (50k req/s) ]
                    │
                    ▼
[ Edge CDN & Bot Shield (Cloudflare / Custom WAF) ]
                    │
                    ▼
[ High-Speed Redis Memory Cluster ] ──(Atomic DECR Operation: Sub-1ms)
        │
        ├── (Stock Depleted: DECR < 0) ──> [ Return Instant "Sold Out" ]
        │
        └── (Stock Reserved: DECR >= 0)
                    │
                    ▼
[ Asynchronous Order Queue (Kafka / RabbitMQ / SQS) ]
                    │
                    ▼
[ Database Ingestion Worker Pool ] ──> [ Batch INSERT Orders to PostgreSQL ]

By decoupling inventory reservation into atomic in-memory Redis keys, the primary database is shielded from concurrency spikes, processing orders in a controlled asynchronous stream.

2. Redlock: Distributed Locking for Inventory Integrity (Node.js)

import Redis from 'ioredis';
import Redlock from 'redlock';

const redisClient = new Redis(process.env.REDIS_URL);
const redlock = new Redlock([redisClient], {
  driftFactor: 0.01,
  retryCount: 3,
  retryDelay: 200,
  retryJitter: 100
});

export async function reserveInventoryItem(productId: string, quantityToReserve: number): Promise<boolean> {
  const resource = `locks:inventory:${productId}`;
  const ttl = 5000; // 5 second lock window

  try {
    const lock = await redlock.acquire([resource], ttl);
    
    // Check available stock in Redis
    const currentStock = await redisClient.get(`stock:${productId}`);
    if (!currentStock || parseInt(currentStock) < quantityToReserve) {
      await lock.release();
      return false; // Insufficient stock
    }

    // Decrement stock atomically
    await redisClient.decrby(`stock:${productId}`, quantityToReserve);
    await lock.release();
    return true;
  } catch (error) {
    console.error('Failed to acquire distributed inventory lock:', error);
    return false;
  }
}

3. ONDC (Open Network for Digital Commerce) Integration Architecture

The Government of India’s ONDC initiative creates an open interoperable network connecting buyers and sellers across independent consumer apps (Paytm, Mystore, Pincode) and seller gateways. Custom e-commerce platforms must implement the Beckn Protocol:

1. Discovery (/search & /on_search): Exposing standardized product catalogs matching national taxonomy.
2. Order Lifecycle (/select, /init, /confirm, /status): Cryptographically signed BAP/BPP requests using Ed25519 digital signatures.
3. Settlement Reconciliation: Real-time integration with ONDC RSP (Reconciliation and Settlement Protocol) for automated merchant payouts.

4. Defending Against Scalper Bots and Carding Attacks

Automated scalper bots use headless browser clusters (Puppeteer, Playwright) and rotating residential proxies to bypass inventory limits and purchase limited-stock items within milliseconds of launch.

Multi-Layered Bot Defense Strategy:

• Proof-of-Work (PoW) Challenge at Checkout: Forcing client browsers to compute a cryptographic SHA-256 hash puzzle before the checkout endpoint accepts submission.
• Device Fingerprinting: Collecting WebGL, canvas rendering, and browser audio context entropy to detect headless Chromium environments.
• SMS / WhatsApp OTP Verification: Requiring Indian mobile phone OTP authentication verified against telecom carrier lookup services for high-value orders.

5. Engaging Cyberfact Security for Enterprise E-Commerce

Cyberfact Security designs, builds, and audits high-concurrency e-commerce platforms for leading consumer brands and retail enterprises across India.

Connect directly with Founder Saket Choudhary on WhatsApp (+91 82520 02914) to architect your next high-scale e-commerce platform.