Timer is not sketchy if it's long enough, but four minutes is probably too short. You need locking for the reasons you said, and if you didn't have an expiratio

Timer is not sketchy if it's long enough, but four minutes is probably too short. You need locking for the reasons you said, and if you didn't have an expiration you'd have fun denial of service either accidentally from users deciding not to purchase, or purposely for the sheer malicious joy or from resellers who would scalp a ticket for a higher price, then use their lock to buy the actual product. Fifteen minutes seems more appropriate, though.