Nottorp, don't be fooled, with Starbucks prices here in Costa Rica, $500 will barely get you a couple of weeks of lattes! Joke too :)

Going back to your serious notes, I successfully replicated the exact mechanics of this bug inside the Console, and it is a classic frontend race condition/bypass flaw:

When your system/keyboard is in a locale that uses commas, the input text box still physically allows you to type a dot (like typing 5.04 or 0.5). The catastrophic UX failure happens because if you press the "Enter" key immediately after typing, the form submits the raw, un-sanitized string to the backend before the frontend validation layer can intercept it, block it, or refresh the "Total due" box.

It completely bypasses its own validation rules (like the $5.00 minimum enforced minimum), skips any error prevention, and fires the single-click payment request to the gateway instantly with the misinterpreted value.

I uploaded the live replication screenshot here: https://ibb.co/HTY88MZ3