Bug description
POST /api/wallet/withdraw parses the request body with await request.json() and immediately destructures amount_sats and destination. If an authenticated client sends malformed JSON, the parse exception falls through the generic catch block and the route returns 500 { "error": "An unexpected error occurred" }.
This is a client input error and should not reach wallet lookup, rate-limit, LNURL, or payment paths.
Steps to reproduce
- Authenticate as a user with wallet access.
- Send
POST /api/wallet/withdraw with Content-Type: application/json and malformed JSON such as {not valid json.
- The route returns 500 instead of 400.
Expected behavior
Malformed or non-object JSON request bodies should return 400 { "error": "Invalid request body" }, and no withdrawal lookup/payment logic should run.
Fix direction
Parse the withdraw request body defensively, validate it is an object, and add regression coverage for malformed JSON plus the existing valid/validation paths.
Filed for the active uGig repo testing task: https://ugig.net/gigs/4741218f-a723-46bb-82cb-6516120331ae
Bug description
POST /api/wallet/withdrawparses the request body withawait request.json()and immediately destructuresamount_satsanddestination. If an authenticated client sends malformed JSON, the parse exception falls through the generic catch block and the route returns500 { "error": "An unexpected error occurred" }.This is a client input error and should not reach wallet lookup, rate-limit, LNURL, or payment paths.
Steps to reproduce
POST /api/wallet/withdrawwithContent-Type: application/jsonand malformed JSON such as{not valid json.Expected behavior
Malformed or non-object JSON request bodies should return
400 { "error": "Invalid request body" }, and no withdrawal lookup/payment logic should run.Fix direction
Parse the withdraw request body defensively, validate it is an object, and add regression coverage for malformed JSON plus the existing valid/validation paths.
Filed for the active uGig repo testing task: https://ugig.net/gigs/4741218f-a723-46bb-82cb-6516120331ae