---
issue: 067
title: "Backend: amount-mismatch check runs after payment saved and offers accepted"
severity: medium
domain: Payment
labels: [bug, backend, logic]
status: open
created: 2026-05-30
source: Full Codebase Audit 2026-05-30
---

# Backend: amount-mismatch check runs after payment saved and offers accepted

**Severity:** medium
**Domain:** Payment
**Labels:** bug, backend, logic

## Description

In `paymentController.ts:886-889`, the check comparing `storedAmount` vs `amount` is executed after the payment has already been saved and offers accepted. If there is a mismatch, those side-effects cannot be rolled back, potentially leaving the system in an inconsistent state.

## Options

1. Move the `storedAmount` vs `amount` check before saving/advancing/accepting offers.
2. Wrap the verify flow in a transaction and roll back on mismatch.
3. Validate amount at intent-creation and re-check before completion.

## Recommendation

Reorder so the amount-mismatch check (and ideally a transaction) gates all side-effects. This is a control-flow/business-logic change.

## Affected Files

- `backend/src/services/payment/paymentController.ts:886-889`

## References

- [Full Codebase Audit 2026-05-30](../09%20-%20Audits/Full%20Codebase%20Audit%20-%202026-05-30.md) — DEC-33