Bug description
POST /api/wallet/deposit parses the request body with await request.json() and immediately reads amount_sats. If an authenticated client sends malformed JSON, the parse exception falls through the generic catch block and the route returns 500 { "error": "An unexpected error occurred" }.
The route also relies on numeric comparisons without first proving amount_sats is a number, so non-numeric JSON values can pass the initial validation path and reach invoice creation.
Steps to reproduce
- Authenticate as a user.
- Send
POST /api/wallet/deposit with Content-Type: application/json and malformed JSON such as {not valid json.
- The route returns 500 instead of 400.
Expected behavior
Malformed or non-object JSON request bodies should return 400 { "error": "Invalid request body" }. Non-integer or out-of-range amounts should return the existing invalid amount client error before wallet lookup or invoice creation.
Fix direction
Parse the deposit request body defensively, validate amount_sats is a whole-number sat amount in range, and add route regression coverage for malformed JSON plus valid invoice creation.
Filed for the active uGig repo testing task: https://ugig.net/gigs/4741218f-a723-46bb-82cb-6516120331ae
Bug description
POST /api/wallet/depositparses the request body withawait request.json()and immediately readsamount_sats. If an authenticated client sends malformed JSON, the parse exception falls through the generic catch block and the route returns500 { "error": "An unexpected error occurred" }.The route also relies on numeric comparisons without first proving
amount_satsis a number, so non-numeric JSON values can pass the initial validation path and reach invoice creation.Steps to reproduce
POST /api/wallet/depositwithContent-Type: application/jsonand malformed JSON such as{not valid json.Expected behavior
Malformed or non-object JSON request bodies should return
400 { "error": "Invalid request body" }. Non-integer or out-of-range amounts should return the existing invalid amount client error before wallet lookup or invoice creation.Fix direction
Parse the deposit request body defensively, validate
amount_satsis a whole-number sat amount in range, and add route regression coverage for malformed JSON plus valid invoice creation.Filed for the active uGig repo testing task: https://ugig.net/gigs/4741218f-a723-46bb-82cb-6516120331ae