---
issue: 096
title: "Backend: validateStatusTransition requires escrowState 'funded' never set on completed payments"
severity: medium
domain: Payment
labels: [bug, backend, state-machine]
status: open
created: 2026-05-30
source: Full Codebase Audit 2026-05-30
---

# Backend: validateStatusTransition requires escrowState 'funded' never set on completed payments

**Severity:** medium
**Domain:** Payment
**Labels:** bug, backend, state-machine

## Description

`marketplaceController.ts:570-583` guards a status transition by querying for `{ status:'completed', escrowState:'funded' }`. The completion flow never sets `escrowState:'funded'`; it is set earlier (at funding time). A genuinely completed payment may not match this query, causing the guard to reject valid transitions.

## Options

1. Query by `status:'completed'` only (drop `escrowState:'funded'`).
2. Ensure the completion flow sets `escrowState:'funded'` consistently and keep the guard.
3. Match on a documented completed-payment predicate aligned with the actual write path.

## Recommendation

Align the guard with what the completion flow actually writes — most safely query `status:'completed'` without the `escrowState` constraint, after confirming no false positives.

## Affected Files

- `backend/src/services/marketplace/marketplaceController.ts:570-583`

## References

- [Full Codebase Audit 2026-05-30](../09%20-%20Audits/Full%20Codebase%20Audit%20-%202026-05-30.md) — DEC-34