Merge pull request #90 from GMWalletApp/dev

Add ePay return relay and simplify multi-architecture builds

.github/workflows/docker-alpine.yml

@@ -1,11 +1,7 @@
 name: docker-alpine-epusdt
 
 on:
-  workflow_dispatch:
   push:
-    branches:
-      - "main"
-      - "master"
     tags:
       - "v*"
 
@@ -34,7 +30,6 @@ jobs:
           tags: |
             type=raw,value=alpine
             type=raw,value=latest
-            type=ref,event=branch,suffix=-alpine
             type=ref,event=tag
             type=sha,prefix=sha-,suffix=-alpine
 
@@ -53,5 +48,6 @@ jobs:
           platforms: linux/amd64,linux/arm64
           build-args: |
             API_RATE_URL=${{ vars.API_RATE_URL }}
+            BUILD_VERSION=${{ github.ref_name }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}

.github/workflows/sync-www.yml

@@ -0,0 +1,101 @@
+name: sync-www
+
+on:
+  push:
+    branches:
+      - dev
+    paths-ignore:
+      - "src/www/**"
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+concurrency:
+  group: sync-www-${{ github.ref_name }}
+  cancel-in-progress: false
+
+jobs:
+  build-and-sync:
+    name: Build Frontend And Sync src/www
+    runs-on: ubuntu-latest
+
+    env:
+      FRONTEND_REPOSITORY: ${{ vars.WWW_FRONTEND_REPOSITORY }}
+      FRONTEND_REF: ${{ vars.WWW_FRONTEND_REF }}
+      FRONTEND_BUILD_DIR: ${{ vars.WWW_FRONTEND_BUILD_DIR }}
+      FRONTEND_TOKEN: ${{ secrets.WWW_FRONTEND_TOKEN }}
+      WWW_TARGET_DIR: src/www
+
+    steps:
+      - name: Checkout Backend
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ github.ref_name }}
+          fetch-depth: 0
+
+      - name: Validate Configuration
+        run: |
+          if [[ -z "$FRONTEND_REPOSITORY" ]]; then
+            echo "Set repository variable WWW_FRONTEND_REPOSITORY, for example owner/repo"
+            exit 1
+          fi
+          if [[ -z "$FRONTEND_REF" ]]; then
+            echo "Set repository variable WWW_FRONTEND_REF, for example main"
+            exit 1
+          fi
+          if [[ -z "$FRONTEND_BUILD_DIR" ]]; then
+            echo "Set repository variable WWW_FRONTEND_BUILD_DIR, for example dist"
+            exit 1
+          fi
+          if [[ -z "$FRONTEND_TOKEN" ]]; then
+            echo "Set repository secret WWW_FRONTEND_TOKEN to read the private frontend repository"
+            exit 1
+          fi
+
+      - name: Clone Frontend
+        run: |
+          frontend_name="${FRONTEND_REPOSITORY##*/}"
+          frontend_path="$RUNNER_TEMP/$frontend_name"
+          git clone \
+            --depth=1 \
+            --branch "$FRONTEND_REF" \
+            "https://x-access-token:${FRONTEND_TOKEN}@github.com/${FRONTEND_REPOSITORY}.git" \
+            "$frontend_path"
+
+      - name: Set Up Bun
+        uses: oven-sh/setup-bun@v2
+
+      - name: Build Frontend
+        run: |
+          frontend_name="${FRONTEND_REPOSITORY##*/}"
+          cd "$RUNNER_TEMP/$frontend_name"
+          bun install
+          bun run build
+
+      - name: Replace src/www
+        run: |
+          frontend_name="${FRONTEND_REPOSITORY##*/}"
+          cd "$RUNNER_TEMP/$frontend_name"
+          if [[ ! -d "$FRONTEND_BUILD_DIR" ]]; then
+            echo "Frontend build output does not exist: $FRONTEND_BUILD_DIR"
+            exit 1
+          fi
+
+          target_path="$GITHUB_WORKSPACE/$WWW_TARGET_DIR"
+          mkdir -p "$target_path"
+          rsync -a --delete "$FRONTEND_BUILD_DIR"/ "$target_path"/
+
+      - name: Commit And Push
+        run: |
+          if [[ -z "$(git status --porcelain -- "$WWW_TARGET_DIR")" ]]; then
+            echo "src/www is already up to date"
+            exit 0
+          fi
+
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add "$WWW_TARGET_DIR"
+          git commit -m "chore(www): sync frontend build"
+          git pull --rebase origin "$GITHUB_REF_NAME"
+          git push origin "HEAD:$GITHUB_REF_NAME"

Dockerfile

@@ -8,8 +8,9 @@ WORKDIR /app
 COPY . /app
 
 WORKDIR /app/src
+ARG BUILD_VERSION=0.0.0-dev
 RUN go mod download
-RUN go build -o /app/epusdt .
+RUN go build -trimpath -ldflags="-s -w -X github.com/GMWalletApp/epusdt/config.BuildVersion=${BUILD_VERSION}" -o /app/epusdt .
 
 FROM alpine:latest AS runner
 ENV TZ=Asia/Shanghai

README.md

@@ -51,13 +51,19 @@
 
 ---
 
+## 安全审计
+Epusdt 已完成第三方安全审计。
+[查看安全审计报告](https://github.com/VectorBits/audit/blob/main/epusdt-secure-audit-report-2026-05-14.pdf)
+
+---
+
 ## 广泛兼容，即插即用
 
 无论你运营的是哪类系统，Epusdt 均可基于现有接口方案，**无需重构业务逻辑**，快速接入，立即获得 Crypto 收款能力，低成本扩展全球支付场景：
 
 | 领域 | 已支持系统 |
 |------|-----------|
-| **AI 分发** | [OneAPI](https://github.com/songquanpeng/one-api)、[NewAPI](https://github.com/QuantumNous/new-api) |
+| **AI 分发** | [Sub2API](https://github.com/Wei-Shaw/sub2api)、[NewAPI](https://github.com/QuantumNous/new-api) |
 | **发卡系统** | [独角数卡（Dujiaoka）](https://dujiao-next.com/)、[异次元发卡](https://github.com/lizhipay/acg-faka) |
 | **代理面板** | [V2Board](https://github.com/v2board/v2board)、[XBoard](https://github.com/cedar2025/Xboard)、[xiaoV2board](https://github.com/wyx2685/v2board/)、[SSPanel](https://github.com/anankke/sspanel-uim) |
 | **建站生态** | [WordPress](https://wordpress.com/)、[WHMCS](https://www.whmcs.com/) |
@@ -104,6 +110,31 @@ Epusdt
 
 ---
 
+## 程序截图
+
+<table>
+  <tr>
+    <td align="center" valign="top">
+      <img src="wiki/img/web2.png" alt="Epusdt 管理面板首页" height="260"><br>
+      <sub>管理面板首页</sub>
+    </td>
+    <td align="center" valign="top">
+      <img src="wiki/img/web1.png" alt="Epusdt 管理面板" height="260"><br>
+      <sub>管理面板</sub>
+    </td>
+    <td align="center" valign="top">
+      <img src="wiki/img/pay1.jpeg" alt="Epusdt 收银台" height="260"><br>
+      <sub>收银台</sub>
+    </td>
+    <td align="center" valign="top">
+      <img src="wiki/img/pay2.jpeg" alt="Epusdt 支付页面" height="260"><br>
+      <sub>支付页面</sub>
+    </td>
+  </tr>
+</table>
+
+---
+
 ## 实现原理
 
 Epusdt 通过监听多条区块链网络（TRC20、ERC20、BEP20、Polygon 等）的 API 或 RPC 节点，实时捕获钱包地址的代币入账事件，利用**金额差异**与**时效性**精确匹配交易归属：

src/.gitignore

@@ -1,3 +1,4 @@
 .DS_Store
 dist/
 *.log
+bin/

src/.goreleaser.yaml

@@ -15,7 +15,7 @@ builds:
     flags:
       - -trimpath
     ldflags:
-      - -s -w -X github.com/assimon/luuu/config.BuildVersion={{ .Version }} -X github.com/assimon/luuu/config.BuildCommit={{ .Commit }} -X github.com/assimon/luuu/config.BuildDate={{ .Date }}
+      - -s -w -X github.com/GMWalletApp/epusdt/config.BuildVersion={{ .Tag }} -X github.com/GMWalletApp/epusdt/config.BuildCommit={{ .Commit }} -X github.com/GMWalletApp/epusdt/config.BuildDate={{ .Date }}
     goos:
       - linux
       - darwin

src/Makefile

@@ -0,0 +1,41 @@
+APP := epusdt
+TARGET_DIR := bin
+BUILD_TAG ?= 0.0.0-dev
+VERSION_PKG := github.com/GMWalletApp/epusdt/config
+LDFLAGS := -s -w -X $(VERSION_PKG).BuildVersion=$(BUILD_TAG)
+
+.PHONY: build release build-all swagger \
+	linux-amd64 linux-arm64 linux-armv7 \
+	darwin-amd64 darwin-arm64 \
+	windows-amd64 windows-arm64
+
+build:
+	go build --trimpath -ldflags="$(LDFLAGS)" -o $(TARGET_DIR)/$(APP) .
+
+release: build
+
+linux-amd64:
+	GOOS=linux GOARCH=amd64 go build --trimpath -ldflags="$(LDFLAGS)" -o $(TARGET_DIR)/$(APP)-linux-amd64 .
+
+linux-arm64:
+	GOOS=linux GOARCH=arm64 go build --trimpath -ldflags="$(LDFLAGS)" -o $(TARGET_DIR)/$(APP)-linux-arm64 .
+
+linux-armv7:
+	GOOS=linux GOARCH=arm GOARM=7 go build --trimpath -ldflags="$(LDFLAGS)" -o $(TARGET_DIR)/$(APP)-linux-armv7 .
+
+darwin-amd64:
+	GOOS=darwin GOARCH=amd64 go build --trimpath -ldflags="$(LDFLAGS)" -o $(TARGET_DIR)/$(APP)-darwin-amd64 .
+
+darwin-arm64:
+	GOOS=darwin GOARCH=arm64 go build --trimpath -ldflags="$(LDFLAGS)" -o $(TARGET_DIR)/$(APP)-darwin-arm64 .
+
+windows-amd64:
+	GOOS=windows GOARCH=amd64 go build --trimpath -ldflags="$(LDFLAGS)" -o $(TARGET_DIR)/$(APP)-windows-amd64.exe .
+
+windows-arm64:
+	GOOS=windows GOARCH=arm64 go build --trimpath -ldflags="$(LDFLAGS)" -o $(TARGET_DIR)/$(APP)-windows-arm64.exe .
+
+build-all: linux-amd64 linux-arm64 linux-armv7 darwin-amd64 darwin-arm64 windows-amd64 windows-arm64
+
+swagger:
+	swag init --outputTypes json,yaml --parseInternal --parseDependency -o docs

src/bootstrap/bootstrap.go

@@ -6,6 +6,7 @@ import (
 	"github.com/GMWalletApp/epusdt/config"
 	"github.com/GMWalletApp/epusdt/model/dao"
 	"github.com/GMWalletApp/epusdt/model/data"
+	"github.com/GMWalletApp/epusdt/model/mdb"
 	"github.com/GMWalletApp/epusdt/mq"
 	"github.com/GMWalletApp/epusdt/task"
 	"github.com/GMWalletApp/epusdt/telegram"
@@ -21,6 +22,13 @@ func InitApp() {
 		config.Init()
 		log.Init()
 		dao.Init()
+		logLevel := data.GetSettingString(mdb.SettingKeySystemLogLevel, mdb.SettingDefaultSystemLogLevel)
+		if err := log.SetLevel(logLevel); err != nil {
+			color.Red.Printf("[bootstrap] apply log level setting %q err=%s; fallback=%s\n", logLevel, err, mdb.SettingDefaultSystemLogLevel)
+			if fallbackErr := log.SetLevel(mdb.SettingDefaultSystemLogLevel); fallbackErr != nil {
+				color.Red.Printf("[bootstrap] apply fallback log level err=%s\n", fallbackErr)
+			}
+		}
 		// Wire settings-table lookups into the config package so
 		// GetRateApiUrl / GetUsdtRate can consult admin-configured values.
 		config.SettingsGetString = func(key string) string {

src/config/config.go

@@ -8,7 +8,6 @@ import (
 	"net/url"
 	"os"
 	"path/filepath"
-	"strconv"
 	"strings"
 	"time"
 
@@ -17,12 +16,6 @@ import (
 	"github.com/tidwall/gjson"
 )
 
-// parseFloat is the minimal helper used by the settings bridge; kept
-// here so settings_bridge.go stays import-free.
-func parseFloat(s string) (float64, error) {
-	return strconv.ParseFloat(strings.TrimSpace(s), 64)
-}
-
 var (
 	HTTPAccessLog      bool
 	SQLDebug           bool
@@ -353,19 +346,29 @@ func GetRateForCoin(coin string, base string) float64 {
 	if coin == base {
 		return 1
 	}
-	if coin == "usdt" {
+	if forcedRate := getForcedRateForCoin(coin, base); forcedRate > 0 {
-		switch base {
+		return forcedRate
-		case "usd":
+	}
+	if coin == "usdt" && base == "usd" {
 		return 1
-		case "cny":
+	}
-			usdtRate := GetUsdtRate()
+	if rate := getRateForCoinFromAPI(coin, base); rate > 0 {
-			if usdtRate > 0 {
+		return rate
-				return 1 / usdtRate
+	}
+	if coin == "ton" {
+		return getRateForCoinFromAPI("toncoin", base)
 	}
 	return 0
+}
+
+func getForcedRateForCoin(coin string, base string) float64 {
+	raw := strings.TrimSpace(settingsForcedRateList())
+	if raw != "" {
+		if rate := gjson.Get(raw, base+"."+coin).Float(); rate > 0 {
+			return rate
 		}
 	}
-	return getRateForCoinFromAPI(coin, base)
+	return 0
 }
 
 func getRateForCoinFromAPI(coin string, base string) float64 {
@@ -401,17 +404,17 @@ func getRateForCoinFromAPI(coin string, base string) float64 {
 }
 
 func GetUsdtRate() float64 {
-	// Only the admin setting can force the USDT/CNY rate. When the
+	// rate.forced_rate_list stores token amount per one base currency unit.
-	// setting is unset, zero, or negative, fall back to the rate API.
+	// GetUsdtRate returns the inverse display value: CNY per USDT.
-	if forced := settingsForcedUsdtRate(); forced > 0 {
+	if forcedRate := getForcedRateForCoin("usdt", "cny"); forcedRate > 0 {
-		return forced
+		return 1 / forcedRate
 	}
 
 	apiRate := getRateForCoinFromAPI("usdt", "cny")
 	if apiRate > 0 {
 		return 1 / apiRate
 	}
-	log.Printf("usdt/cny rate unavailable: rate.forced_usdt_rate <= 0 and rate api returned no data")
+	log.Printf("usdt/cny rate unavailable: rate.forced_rate_list has no positive cny.usdt entry and rate api returned no data")
 	return 0
 }
 

src/config/config_test.go

@@ -231,7 +231,7 @@ func TestCopyMissingStaticFilesCopiesAssetsWithoutOverwriting(t *testing.T) {
 	}
 }
 
-func TestGetUsdtRatePrefersPositiveAdminOverride(t *testing.T) {
+func TestGetUsdtRatePrefersForcedRateList(t *testing.T) {
 	viper.Reset()
 	t.Cleanup(viper.Reset)
 	t.Setenv("API_RATE_URL", "")
@@ -249,16 +249,19 @@ func TestGetUsdtRatePrefersPositiveAdminOverride(t *testing.T) {
 	})
 
 	installSettingsGetter(t, map[string]string{
-		"rate.forced_usdt_rate": "7.25",
+		"rate.forced_rate_list": `{"cny":{"usdt":0.13793103448275862},"usd":{"trx":123.45}}`,
 		"rate.api_url":          "https://rate.example.test",
 	})
 
 	got := GetUsdtRate()
-	if got != 7.25 {
+	if math.Abs(got-7.25) > 1e-9 {
 		t.Fatalf("GetUsdtRate() = %v, want 7.25", got)
 	}
+	if rate := GetRateForCoin("trx", "usd"); rate != 123.45 {
+		t.Fatalf("GetRateForCoin(trx, usd) = %v, want 123.45", rate)
+	}
 	if apiCalled {
-		t.Fatalf("rate API should not be called when rate.forced_usdt_rate > 0")
+		t.Fatalf("rate API should not be called when rate.forced_rate_list has positive rate")
 	}
 }
 
@@ -281,7 +284,7 @@ func TestGetUsdtRateUsesAPIWhenAdminOverrideIsNotPositive(t *testing.T) {
 	})
 
 	installSettingsGetter(t, map[string]string{
-		"rate.forced_usdt_rate": "-1",
+		"rate.forced_rate_list": `{"cny":{"usdt":0}}`,
 		"rate.api_url":          "https://rate.example.test",
 	})
 
@@ -297,6 +300,64 @@ func TestGetUsdtRateUsesAPIWhenAdminOverrideIsNotPositive(t *testing.T) {
 	}
 }
 
+func TestGetRateForCoinUsesAPIWhenForcedPairMissing(t *testing.T) {
+	viper.Reset()
+	t.Cleanup(viper.Reset)
+	t.Setenv("API_RATE_URL", "")
+
+	installMockHTTPClient(t, func(r *http.Request) (*http.Response, error) {
+		if r.URL.Path != "/cny.json" {
+			t.Fatalf("rate api path = %s, want /cny.json", r.URL.Path)
+		}
+		return &http.Response{
+			StatusCode: http.StatusOK,
+			Status:     "200 OK",
+			Header:     http.Header{"Content-Type": []string{"application/json"}},
+			Body:       io.NopCloser(strings.NewReader(`{"cny":{"usdt":0.14635}}`)),
+			Request:    r,
+		}, nil
+	})
+
+	installSettingsGetter(t, map[string]string{
+		"rate.forced_rate_list": `{"usd":{"trx":123.45}}`,
+		"rate.api_url":          "https://rate.example.test",
+	})
+
+	rate := GetRateForCoin("usdt", "cny")
+	if math.Abs(rate-0.14635) > 1e-9 {
+		t.Fatalf("GetRateForCoin(usdt, cny) = %v, want 0.14635", rate)
+	}
+}
+
+func TestGetRateForCoinUsesToncoinAPIFallbackForTon(t *testing.T) {
+	viper.Reset()
+	t.Cleanup(viper.Reset)
+	t.Setenv("API_RATE_URL", "")
+
+	installMockHTTPClient(t, func(r *http.Request) (*http.Response, error) {
+		if r.URL.Path != "/cny.json" {
+			t.Fatalf("rate api path = %s, want /cny.json", r.URL.Path)
+		}
+		return &http.Response{
+			StatusCode: http.StatusOK,
+			Status:     "200 OK",
+			Header:     http.Header{"Content-Type": []string{"application/json"}},
+			Body:       io.NopCloser(strings.NewReader(`{"cny":{"toncoin":1.82}}`)),
+			Request:    r,
+		}, nil
+	})
+
+	installSettingsGetter(t, map[string]string{
+		"rate.forced_rate_list": `{"cny":{"ton":0}}`,
+		"rate.api_url":          "https://rate.example.test",
+	})
+
+	rate := GetRateForCoin("ton", "cny")
+	if math.Abs(rate-1.82) > 1e-9 {
+		t.Fatalf("GetRateForCoin(ton, cny) = %v, want 1.82", rate)
+	}
+}
+
 func TestGetUsdtRateReturnsZeroWhenAPIUnavailableWithoutAdminOverride(t *testing.T) {
 	viper.Reset()
 	t.Cleanup(viper.Reset)
@@ -313,7 +374,7 @@ func TestGetUsdtRateReturnsZeroWhenAPIUnavailableWithoutAdminOverride(t *testing
 	})
 
 	installSettingsGetter(t, map[string]string{
-		"rate.forced_usdt_rate": "0",
+		"rate.forced_rate_list": `{"cny":{"usdt":0}}`,
 		"rate.api_url":          "https://rate.example.test",
 	})
 
@@ -343,7 +404,7 @@ func TestGetRateForCoinCallsRateAPIOnceForUsdtCnyFailure(t *testing.T) {
 	})
 
 	installSettingsGetter(t, map[string]string{
-		"rate.forced_usdt_rate": "0",
+		"rate.forced_rate_list": `{"cny":{"usdt":0}}`,
 		"rate.api_url":          "https://rate.example.test",
 	})
 

src/config/settings_bridge.go

@@ -18,17 +18,9 @@ func settingsRateApiUrl() string {
 	return SettingsGetString("rate.api_url")
 }
 
-func settingsForcedUsdtRate() float64 {
+func settingsForcedRateList() string {
 	if SettingsGetString == nil {
-		return 0
+		return ""
 	}
-	raw := SettingsGetString("rate.forced_usdt_rate")
+	return SettingsGetString("rate.forced_rate_list")
-	if raw == "" {
-		return 0
-	}
-	f, err := parseFloat(raw)
-	if err != nil {
-		return 0
-	}
-	return f
 }

src/controller/admin/api_key_controller.go

@@ -3,12 +3,12 @@ package admin
 import (
 	"crypto/rand"
 	"encoding/hex"
-	"errors"
 	"strconv"
 	"strings"
 
 	"github.com/GMWalletApp/epusdt/model/data"
 	"github.com/GMWalletApp/epusdt/model/mdb"
+	"github.com/GMWalletApp/epusdt/util/constant"
 	"github.com/labstack/echo/v4"
 )
 
@@ -79,7 +79,7 @@ func (c *BaseAdminController) ListApiKeys(ctx echo.Context) error {
 func (c *BaseAdminController) CreateApiKey(ctx echo.Context) error {
 	req := new(CreateApiKeyRequest)
 	if err := ctx.Bind(req); err != nil {
-		return c.FailJson(ctx, err)
+		return c.FailJson(ctx, constant.ParamsMarshalErr)
 	}
 	if err := c.ValidateStruct(ctx, req); err != nil {
 		return c.FailJson(ctx, err)
@@ -150,11 +150,11 @@ func isUniqueViolation(err error) bool {
 func (c *BaseAdminController) UpdateApiKey(ctx echo.Context) error {
 	id, err := strconv.ParseUint(ctx.Param("id"), 10, 64)
 	if err != nil {
-		return c.FailJson(ctx, err)
+		return c.FailJson(ctx, constant.ParamsMarshalErr)
 	}
 	req := new(UpdateApiKeyRequest)
 	if err := ctx.Bind(req); err != nil {
-		return c.FailJson(ctx, err)
+		return c.FailJson(ctx, constant.ParamsMarshalErr)
 	}
 	fields := map[string]interface{}{}
 	if req.Name != nil {
@@ -187,11 +187,11 @@ func (c *BaseAdminController) UpdateApiKey(ctx echo.Context) error {
 func (c *BaseAdminController) ChangeApiKeyStatus(ctx echo.Context) error {
 	id, err := strconv.ParseUint(ctx.Param("id"), 10, 64)
 	if err != nil {
-		return c.FailJson(ctx, err)
+		return c.FailJson(ctx, constant.ParamsMarshalErr)
 	}
 	req := new(ChangeApiKeyStatusRequest)
 	if err := ctx.Bind(req); err != nil {
-		return c.FailJson(ctx, err)
+		return c.FailJson(ctx, constant.ParamsMarshalErr)
 	}
 	if err := c.ValidateStruct(ctx, req); err != nil {
 		return c.FailJson(ctx, err)
@@ -215,7 +215,7 @@ func (c *BaseAdminController) ChangeApiKeyStatus(ctx echo.Context) error {
 func (c *BaseAdminController) RotateApiKeySecret(ctx echo.Context) error {
 	id, err := strconv.ParseUint(ctx.Param("id"), 10, 64)
 	if err != nil {
-		return c.FailJson(ctx, err)
+		return c.FailJson(ctx, constant.ParamsMarshalErr)
 	}
 	secret := randomHex(32)
 	if err := data.UpdateApiKeyFields(id, map[string]interface{}{"secret_key": secret}); err != nil {
@@ -239,7 +239,7 @@ func (c *BaseAdminController) RotateApiKeySecret(ctx echo.Context) error {
 func (c *BaseAdminController) DeleteApiKey(ctx echo.Context) error {
 	id, err := strconv.ParseUint(ctx.Param("id"), 10, 64)
 	if err != nil {
-		return c.FailJson(ctx, err)
+		return c.FailJson(ctx, constant.ParamsMarshalErr)
 	}
 	if err := data.DeleteApiKeyByID(id); err != nil {
 		return c.FailJson(ctx, err)
@@ -262,14 +262,14 @@ func (c *BaseAdminController) DeleteApiKey(ctx echo.Context) error {
 func (c *BaseAdminController) GetApiKeyStats(ctx echo.Context) error {
 	id, err := strconv.ParseUint(ctx.Param("id"), 10, 64)
 	if err != nil {
-		return c.FailJson(ctx, err)
+		return c.FailJson(ctx, constant.ParamsMarshalErr)
 	}
 	row, err := data.GetApiKeyByID(id)
 	if err != nil {
 		return c.FailJson(ctx, err)
 	}
 	if row.ID == 0 {
-		return c.FailJson(ctx, errors.New("api key not found"))
+		return c.FailJson(ctx, constant.ApiKeyNotFoundErr)
 	}
 	return c.SucJson(ctx, map[string]interface{}{
 		"call_count":   row.CallCount,
@@ -291,14 +291,14 @@ func (c *BaseAdminController) GetApiKeyStats(ctx echo.Context) error {
 func (c *BaseAdminController) GetApiKeySecret(ctx echo.Context) error {
 	id, err := strconv.ParseUint(ctx.Param("id"), 10, 64)
 	if err != nil {
-		return c.FailJson(ctx, err)
+		return c.FailJson(ctx, constant.ParamsMarshalErr)
 	}
 	row, err := data.GetApiKeyByID(id)
 	if err != nil {
 		return c.FailJson(ctx, err)
 	}
 	if row.ID == 0 {
-		return c.FailJson(ctx, errors.New("api key not found"))
+		return c.FailJson(ctx, constant.ApiKeyNotFoundErr)
 	}
 	return c.SucJson(ctx, map[string]string{"secret_key": row.SecretKey})
 }

src/controller/admin/auth_controller.go

@@ -5,6 +5,7 @@ import (
 
 	"github.com/GMWalletApp/epusdt/model/data"
 	"github.com/GMWalletApp/epusdt/model/mdb"
+	"github.com/GMWalletApp/epusdt/util/constant"
 	appjwt "github.com/GMWalletApp/epusdt/util/jwt"
 	"github.com/labstack/echo/v4"
 )
@@ -53,7 +54,7 @@ type InitialPasswordResponse struct {
 func (c *BaseAdminController) Login(ctx echo.Context) error {
 	req := new(LoginRequest)
 	if err := ctx.Bind(req); err != nil {
-		return c.FailJson(ctx, err)
+		return c.FailJson(ctx, constant.ParamsMarshalErr)
 	}
 	if err := c.ValidateStruct(ctx, req); err != nil {
 		return c.FailJson(ctx, err)
@@ -63,10 +64,10 @@ func (c *BaseAdminController) Login(ctx echo.Context) error {
 		return c.FailJson(ctx, err)
 	}
 	if user.ID == 0 || !data.VerifyPassword(user.PasswordHash, req.Password) {
-		return c.FailJson(ctx, errors.New("invalid username or password"))
+		return c.FailJson(ctx, constant.AdminInvalidCredentialErr)
 	}
 	if user.Status != mdb.AdminUserStatusEnable {
-		return c.FailJson(ctx, errors.New("user disabled"))
+		return c.FailJson(ctx, constant.AdminUserDisabledErr)
 	}
 	token, err := appjwt.Sign(user.ID, user.Username)
 	if err != nil {
@@ -94,6 +95,9 @@ func (c *BaseAdminController) Login(ctx echo.Context) error {
 func (c *BaseAdminController) GetInitialPassword(ctx echo.Context) error {
 	password, err := data.ConsumeInitialAdminPassword()
 	if err != nil {
+		if errors.Is(err, data.ErrInitAdminPasswordAlreadyFetched) || errors.Is(err, data.ErrInitAdminPasswordUnavailable) {
+			return c.FailJson(ctx, constant.InitialAdminPasswordErr)
+		}
 		return c.FailJson(ctx, err)
 	}
 	return c.SucJson(ctx, InitialPasswordResponse{
@@ -144,14 +148,14 @@ func (c *BaseAdminController) Logout(ctx echo.Context) error {
 func (c *BaseAdminController) Me(ctx echo.Context) error {
 	uid := currentAdminUserID(ctx)
 	if uid == 0 {
-		return c.FailJson(ctx, errors.New("unauthorized"))
+		return c.FailJson(ctx, constant.AdminUnauthorizedErr)
 	}
 	user, err := data.GetAdminUserByID(uid)
 	if err != nil {
 		return c.FailJson(ctx, err)
 	}
 	if user.ID == 0 {
-		return c.FailJson(ctx, errors.New("user not found"))
+		return c.FailJson(ctx, constant.AdminUserNotFoundErr)
 	}
 	// Warn the frontend when the operator hasn't changed the seeded
 	// initial password.
@@ -176,11 +180,11 @@ func (c *BaseAdminController) Me(ctx echo.Context) error {
 func (c *BaseAdminController) ChangePassword(ctx echo.Context) error {
 	uid := currentAdminUserID(ctx)
 	if uid == 0 {
-		return c.FailJson(ctx, errors.New("unauthorized"))
+		return c.FailJson(ctx, constant.AdminUnauthorizedErr)
 	}
 	req := new(ChangePasswordRequest)
 	if err := ctx.Bind(req); err != nil {
-		return c.FailJson(ctx, err)
+		return c.FailJson(ctx, constant.ParamsMarshalErr)
 	}
 	if err := c.ValidateStruct(ctx, req); err != nil {
 		return c.FailJson(ctx, err)
@@ -190,7 +194,7 @@ func (c *BaseAdminController) ChangePassword(ctx echo.Context) error {
 		return c.FailJson(ctx, err)
 	}
 	if user.ID == 0 || !data.VerifyPassword(user.PasswordHash, req.OldPassword) {
-		return c.FailJson(ctx, errors.New("old password incorrect"))
+		return c.FailJson(ctx, constant.AdminOldPasswordErr)
 	}
 	if err := data.UpdateAdminUserPassword(uid, req.NewPassword); err != nil {
 		return c.FailJson(ctx, err)

src/controller/admin/chain_controller.go

@@ -2,6 +2,7 @@ package admin
 
 import (
 	"github.com/GMWalletApp/epusdt/model/data"
+	"github.com/GMWalletApp/epusdt/util/constant"
 	"github.com/labstack/echo/v4"
 )
 
@@ -13,8 +14,7 @@ type UpdateChainRequest struct {
 	DisplayName      *string `json:"display_name" example:"Tron"`
 }
 
-// ListChains returns the chains table (tron/ethereum/solana seeded; new
+// ListChains returns the chains table for all seeded supported networks.
-// networks like bsc/polygon inserted manually once supported).
 // @Summary      List chains
 // @Description  Returns all supported blockchain networks
 // @Tags         Admin Chains
@@ -40,7 +40,7 @@ func (c *BaseAdminController) ListChains(ctx echo.Context) error {
 // @Security     AdminJWT
 // @Accept       json
 // @Produce      json
-// @Param        network path string true "Network name (e.g. tron, ethereum, solana)"
+// @Param        network path string true "Network name (e.g. ton, tron, ethereum, solana)"
 // @Param        request body admin.UpdateChainRequest true "Chain settings"
 // @Success      200 {object} response.ApiResponse
 // @Failure      400 {object} response.ApiResponse
@@ -49,7 +49,7 @@ func (c *BaseAdminController) UpdateChain(ctx echo.Context) error {
 	network := ctx.Param("network")
 	req := new(UpdateChainRequest)
 	if err := ctx.Bind(req); err != nil {
-		return c.FailJson(ctx, err)
+		return c.FailJson(ctx, constant.ParamsMarshalErr)
 	}
 	fields := map[string]interface{}{}
 	if req.Enabled != nil {

src/controller/admin/chain_token_controller.go

@@ -6,6 +6,7 @@ import (
 
 	"github.com/GMWalletApp/epusdt/model/data"
 	"github.com/GMWalletApp/epusdt/model/mdb"
+	"github.com/GMWalletApp/epusdt/util/constant"
 	"github.com/labstack/echo/v4"
 )
 
@@ -65,7 +66,7 @@ func (c *BaseAdminController) ListChainTokens(ctx echo.Context) error {
 func (c *BaseAdminController) CreateChainToken(ctx echo.Context) error {
 	req := new(CreateChainTokenRequest)
 	if err := ctx.Bind(req); err != nil {
-		return c.FailJson(ctx, err)
+		return c.FailJson(ctx, constant.ParamsMarshalErr)
 	}
 	if err := c.ValidateStruct(ctx, req); err != nil {
 		return c.FailJson(ctx, err)
@@ -107,11 +108,11 @@ func (c *BaseAdminController) CreateChainToken(ctx echo.Context) error {
 func (c *BaseAdminController) UpdateChainToken(ctx echo.Context) error {
 	id, err := strconv.ParseUint(ctx.Param("id"), 10, 64)
 	if err != nil {
-		return c.FailJson(ctx, err)
+		return c.FailJson(ctx, constant.ParamsMarshalErr)
 	}
 	req := new(UpdateChainTokenRequest)
 	if err := ctx.Bind(req); err != nil {
-		return c.FailJson(ctx, err)
+		return c.FailJson(ctx, constant.ParamsMarshalErr)
 	}
 	fields := map[string]interface{}{}
 	if req.ContractAddress != nil {
@@ -147,11 +148,11 @@ func (c *BaseAdminController) UpdateChainToken(ctx echo.Context) error {
 func (c *BaseAdminController) ChangeChainTokenStatus(ctx echo.Context) error {
 	id, err := strconv.ParseUint(ctx.Param("id"), 10, 64)
 	if err != nil {
-		return c.FailJson(ctx, err)
+		return c.FailJson(ctx, constant.ParamsMarshalErr)
 	}
 	req := new(ChangeChainTokenStatusRequest)
 	if err := ctx.Bind(req); err != nil {
-		return c.FailJson(ctx, err)
+		return c.FailJson(ctx, constant.ParamsMarshalErr)
 	}
 	if err := data.UpdateChainTokenFields(id, map[string]interface{}{"enabled": req.Enabled}); err != nil {
 		return c.FailJson(ctx, err)
@@ -172,7 +173,7 @@ func (c *BaseAdminController) ChangeChainTokenStatus(ctx echo.Context) error {
 func (c *BaseAdminController) DeleteChainToken(ctx echo.Context) error {
 	id, err := strconv.ParseUint(ctx.Param("id"), 10, 64)
 	if err != nil {
-		return c.FailJson(ctx, err)
+		return c.FailJson(ctx, constant.ParamsMarshalErr)
 	}
 	if err := data.DeleteChainTokenByID(id); err != nil {
 		return c.FailJson(ctx, err)

src/controller/admin/dashboard_controller.go

@@ -1,6 +1,9 @@
 package admin
 
 import (
+	"encoding/json"
+	"fmt"
+	"net/http"
 	"strconv"
 	"strings"
 	"time"
@@ -29,6 +32,49 @@ type OrderStatsResponse struct {
 	ExpiredUnpaidCount int64   `json:"expired_unpaid_count" example:"10"`
 }
 
+// RpcStatsDashboardResponse is the RPC runtime stats payload.
+type RpcStatsDashboardResponse struct {
+	GeneratedAt string                  `json:"generated_at" example:"2026-06-09T12:00:00+08:00"`
+	Summary     RpcStatsSummaryResponse `json:"summary"`
+	Chains      []RpcStatsChainResponse `json:"chains"`
+}
+
+// RpcStatsSummaryResponse is the overall RPC runtime summary.
+type RpcStatsSummaryResponse struct {
+	TotalChains    int     `json:"total_chains" example:"6"`
+	EnabledChains  int     `json:"enabled_chains" example:"5"`
+	ActiveChains   int     `json:"active_chains" example:"4"`
+	OkChains       int     `json:"ok_chains" example:"3"`
+	WarningChains  int     `json:"warning_chains" example:"1"`
+	DownChains     int     `json:"down_chains" example:"0"`
+	UnknownChains  int     `json:"unknown_chains" example:"1"`
+	DisabledChains int     `json:"disabled_chains" example:"1"`
+	SuccessCount   int64   `json:"success_count" example:"123"`
+	FailureCount   int64   `json:"failure_count" example:"2"`
+	SuccessRate    float64 `json:"success_rate" example:"0.984"`
+}
+
+// RpcStatsChainResponse is one chain's in-process RPC runtime stats.
+type RpcStatsChainResponse struct {
+	Network           string  `json:"network" example:"tron"`
+	DisplayName       string  `json:"display_name" example:"TRON"`
+	Enabled           bool    `json:"enabled" example:"true"`
+	HasData           bool    `json:"has_data" example:"true"`
+	Status            string  `json:"status" example:"ok" enums:"ok,warning,down,unknown,disabled"`
+	SuccessCount      int64   `json:"success_count" example:"123"`
+	FailureCount      int64   `json:"failure_count" example:"2"`
+	SuccessRate       float64 `json:"success_rate" example:"0.984"`
+	LatestBlockHeight int64   `json:"latest_block_height" example:"64532100"`
+	LastSyncAt        string  `json:"last_sync_at" example:"2026-06-09T12:00:00+08:00"`
+}
+
+type rpcStatsStreamEnvelope struct {
+	StatusCode int                       `json:"status_code"`
+	Message    string                    `json:"message"`
+	Data       RpcStatsDashboardResponse `json:"data"`
+	RequestID  string                    `json:"request_id"`
+}
+
 // RpcHealthCheckResponse is the response for a health check probe.
 type RpcHealthCheckResponse struct {
 	// 健康状态 unknown=未知 ok=正常 down=异常
@@ -51,14 +97,16 @@ type RotateSecretResponse struct {
 type BatchImportResult struct {
 	Address   string `json:"address" example:"TTestTronAddress001"`
 	OK        bool   `json:"ok" example:"true"`
-	Error   string `json:"error,omitempty" example:""`
+	ErrorCode int    `json:"error_code,omitempty" example:"10001"`
+	Error     string `json:"error,omitempty" example:"wallet address already exists"`
 }
 
 // SettingsUpsertResult is one row in the settings upsert response.
 type SettingsUpsertResult struct {
 	Key       string `json:"key" example:"rate.api_url"`
 	OK        bool   `json:"ok" example:"true"`
-	Error string `json:"error,omitempty" example:""`
+	ErrorCode int    `json:"error_code,omitempty" example:"10043"`
+	Error     string `json:"error,omitempty" example:"invalid setting item"`
 }
 
 // Overview returns the top-card numbers for the dashboard landing page.
@@ -228,6 +276,174 @@ func (c *BaseAdminController) OrderStats(ctx echo.Context) error {
 	})
 }
 
+// RpcStats returns process-local RPC runtime counters grouped by chain.
+// Values reset on process restart and are not persisted to the database.
+// @Summary      RPC runtime statistics
+// @Description  Streams in-process RPC success/failure counts, success rate, latest block height and last sync time by chain over one authenticated SSE connection.
+// @Tags         Admin Dashboard
+// @Security     AdminJWT
+// @Produce      text/event-stream
+// @Success      200 {object} response.ApiResponse{data=admin.RpcStatsDashboardResponse}
+// @Failure      400 {object} response.ApiResponse
+// @Router       /admin/api/v1/dashboard/rpc-stats [get]
+func (c *BaseAdminController) RpcStats(ctx echo.Context) error {
+	return c.streamRpcStats(ctx)
+}
+
+func buildRpcStatsResponse() (RpcStatsDashboardResponse, error) {
+	chains, err := data.ListChains()
+	if err != nil {
+		return RpcStatsDashboardResponse{}, err
+	}
+	stats := data.SnapshotRpcRuntimeStats()
+	now := time.Now()
+	resp := RpcStatsDashboardResponse{
+		GeneratedAt: now.Format(time.RFC3339),
+		Chains:      make([]RpcStatsChainResponse, 0, len(chains)),
+	}
+	for _, chain := range chains {
+		network := strings.ToLower(strings.TrimSpace(chain.Network))
+		stat := stats[network]
+		successRate := rpcStatsSuccessRate(stat.SuccessCount, stat.FailureCount)
+		hasData := stat.SuccessCount+stat.FailureCount > 0
+		status := rpcStatsStatus(chain.Enabled, stat.SuccessCount, stat.FailureCount)
+		lastSyncAt := ""
+		if !stat.LastSyncAt.IsZero() {
+			lastSyncAt = stat.LastSyncAt.Format(time.RFC3339)
+		}
+
+		resp.Summary.TotalChains++
+		if chain.Enabled {
+			resp.Summary.EnabledChains++
+		}
+		if hasData {
+			resp.Summary.ActiveChains++
+		}
+		switch status {
+		case "ok":
+			resp.Summary.OkChains++
+		case "warning":
+			resp.Summary.WarningChains++
+		case "down":
+			resp.Summary.DownChains++
+		case "disabled":
+			resp.Summary.DisabledChains++
+		default:
+			resp.Summary.UnknownChains++
+		}
+		resp.Summary.SuccessCount += stat.SuccessCount
+		resp.Summary.FailureCount += stat.FailureCount
+
+		resp.Chains = append(resp.Chains, RpcStatsChainResponse{
+			Network:           chain.Network,
+			DisplayName:       rpcStatsDisplayName(chain.Network, chain.DisplayName),
+			Enabled:           chain.Enabled,
+			HasData:           hasData,
+			Status:            status,
+			SuccessCount:      stat.SuccessCount,
+			FailureCount:      stat.FailureCount,
+			SuccessRate:       successRate,
+			LatestBlockHeight: stat.LatestBlockHeight,
+			LastSyncAt:        lastSyncAt,
+		})
+	}
+	resp.Summary.SuccessRate = rpcStatsSuccessRate(resp.Summary.SuccessCount, resp.Summary.FailureCount)
+	return resp, nil
+}
+
+func (c *BaseAdminController) streamRpcStats(ctx echo.Context) error {
+	initial, err := buildRpcStatsResponse()
+	if err != nil {
+		return c.FailJson(ctx, err)
+	}
+
+	resp := ctx.Response()
+	resp.Header().Set(echo.HeaderContentType, "text/event-stream; charset=utf-8")
+	resp.Header().Set("Cache-Control", "no-cache")
+	resp.Header().Set("Connection", "keep-alive")
+	resp.Header().Set("X-Accel-Buffering", "no")
+
+	flusher, ok := resp.Writer.(http.Flusher)
+	if !ok {
+		return echo.NewHTTPError(http.StatusInternalServerError, "streaming unsupported")
+	}
+
+	resp.WriteHeader(http.StatusOK)
+	if _, err := fmt.Fprint(resp.Writer, "retry: 5000\n\n"); err != nil {
+		return err
+	}
+	if err := writeRpcStatsSSE(ctx, flusher, initial); err != nil {
+		return err
+	}
+
+	ticker := time.NewTicker(5 * time.Second)
+	defer ticker.Stop()
+
+	for {
+		select {
+		case <-ctx.Request().Context().Done():
+			return nil
+		case <-ticker.C:
+			payload, err := buildRpcStatsResponse()
+			if err != nil {
+				return err
+			}
+			if err := writeRpcStatsSSE(ctx, flusher, payload); err != nil {
+				return err
+			}
+		}
+	}
+}
+
+func writeRpcStatsSSE(ctx echo.Context, flusher http.Flusher, payload RpcStatsDashboardResponse) error {
+	envelope := rpcStatsStreamEnvelope{
+		StatusCode: http.StatusOK,
+		Message:    "success",
+		Data:       payload,
+		RequestID:  ctx.Request().Header.Get(echo.HeaderXRequestID),
+	}
+	b, err := json.Marshal(envelope)
+	if err != nil {
+		return err
+	}
+	if _, err := fmt.Fprintf(ctx.Response().Writer, "event: rpc_stats\ndata: %s\n\n", b); err != nil {
+		return err
+	}
+	flusher.Flush()
+	return nil
+}
+
+func rpcStatsDisplayName(network string, displayName string) string {
+	if name := strings.TrimSpace(displayName); name != "" {
+		return name
+	}
+	return strings.TrimSpace(network)
+}
+
+func rpcStatsSuccessRate(successCount, failureCount int64) float64 {
+	total := successCount + failureCount
+	if total <= 0 {
+		return 0
+	}
+	return float64(successCount) / float64(total)
+}
+
+func rpcStatsStatus(enabled bool, successCount, failureCount int64) string {
+	if !enabled {
+		return "disabled"
+	}
+	if successCount+failureCount == 0 {
+		return "unknown"
+	}
+	if successCount == 0 {
+		return "down"
+	}
+	if failureCount > 0 {
+		return "warning"
+	}
+	return "ok"
+}
+
 // RecentOrders returns the last N orders for the dashboard list card.
 // @Summary      Recent orders
 // @Description  Returns the last N orders for the dashboard

src/controller/admin/notification_controller.go

@@ -2,7 +2,6 @@ package admin
 
 import (
 	"encoding/json"
-	"errors"
 	"strconv"
 	"strings"
 
@@ -10,6 +9,7 @@ import (
 	"github.com/GMWalletApp/epusdt/model/mdb"
 	"github.com/GMWalletApp/epusdt/notify"
 	"github.com/GMWalletApp/epusdt/telegram"
+	"github.com/GMWalletApp/epusdt/util/constant"
 	"github.com/labstack/echo/v4"
 )
 
@@ -69,7 +69,7 @@ func (c *BaseAdminController) ListNotificationChannels(ctx echo.Context) error {
 func (c *BaseAdminController) CreateNotificationChannel(ctx echo.Context) error {
 	req := new(CreateNotificationChannelRequest)
 	if err := ctx.Bind(req); err != nil {
-		return c.FailJson(ctx, err)
+		return c.FailJson(ctx, constant.ParamsMarshalErr)
 	}
 	req.Type = strings.ToLower(strings.TrimSpace(req.Type))
 	if err := c.ValidateStruct(ctx, req); err != nil {
@@ -120,7 +120,7 @@ func (c *BaseAdminController) CreateNotificationChannel(ctx echo.Context) error
 func (c *BaseAdminController) UpdateNotificationChannel(ctx echo.Context) error {
 	id, err := strconv.ParseUint(ctx.Param("id"), 10, 64)
 	if err != nil {
-		return c.FailJson(ctx, err)
+		return c.FailJson(ctx, constant.ParamsMarshalErr)
 	}
 	existing, err := data.GetNotificationChannelByID(id)
 	if err != nil {
@@ -130,7 +130,7 @@ func (c *BaseAdminController) UpdateNotificationChannel(ctx echo.Context) error
 
 	req := new(UpdateNotificationChannelRequest)
 	if err := ctx.Bind(req); err != nil {
-		return c.FailJson(ctx, err)
+		return c.FailJson(ctx, constant.ParamsMarshalErr)
 	}
 	fields := map[string]interface{}{}
 	if req.Name != nil {
@@ -175,7 +175,7 @@ func (c *BaseAdminController) UpdateNotificationChannel(ctx echo.Context) error
 func (c *BaseAdminController) ChangeNotificationChannelStatus(ctx echo.Context) error {
 	id, err := strconv.ParseUint(ctx.Param("id"), 10, 64)
 	if err != nil {
-		return c.FailJson(ctx, err)
+		return c.FailJson(ctx, constant.ParamsMarshalErr)
 	}
 	existing, err := data.GetNotificationChannelByID(id)
 	if err != nil {
@@ -185,7 +185,7 @@ func (c *BaseAdminController) ChangeNotificationChannelStatus(ctx echo.Context)
 
 	req := new(ChangeChannelStatusRequest)
 	if err := ctx.Bind(req); err != nil {
-		return c.FailJson(ctx, err)
+		return c.FailJson(ctx, constant.ParamsMarshalErr)
 	}
 	if err := data.UpdateNotificationChannelFields(id, map[string]interface{}{"enabled": req.Enabled}); err != nil {
 		return c.FailJson(ctx, err)
@@ -209,7 +209,7 @@ func (c *BaseAdminController) ChangeNotificationChannelStatus(ctx echo.Context)
 func (c *BaseAdminController) DeleteNotificationChannel(ctx echo.Context) error {
 	id, err := strconv.ParseUint(ctx.Param("id"), 10, 64)
 	if err != nil {
-		return c.FailJson(ctx, err)
+		return c.FailJson(ctx, constant.ParamsMarshalErr)
 	}
 	existing, err := data.GetNotificationChannelByID(id)
 	if err != nil {
@@ -230,12 +230,12 @@ func (c *BaseAdminController) DeleteNotificationChannel(ctx echo.Context) error
 // + chat_id; webhook/email kept loose until those senders exist.
 func validateChannelConfig(channelType string, cfg map[string]interface{}) error {
 	if cfg == nil {
-		return errors.New("config required")
+		return constant.NotificationConfigErr
 	}
 	if channelType == mdb.NotificationTypeTelegram {
 		configJSON, _ := json.Marshal(cfg)
 		if _, err := notify.ParseTelegramConfig(string(configJSON)); err != nil {
-			return err
+			return constant.NotificationConfigErr
 		}
 	}
 	return nil
@@ -260,10 +260,10 @@ func normalizeChannelEvents(raw interface{}) (map[string]bool, error) {
 			case "1", "true", "on", "yes":
 				return true, nil
 			default:
-				return false, errors.New("invalid boolean string")
+				return false, constant.NotificationEventsErr
 			}
 		default:
-			return false, errors.New("invalid event value type")
+			return false, constant.NotificationEventsErr
 		}
 	}
 
@@ -299,7 +299,7 @@ func normalizeChannelEvents(raw interface{}) (map[string]bool, error) {
 		for _, v := range t {
 			s, ok := v.(string)
 			if !ok {
-				return nil, errors.New("events array must contain strings")
+				return nil, constant.NotificationEventsErr
 			}
 			s = trimKey(s)
 			if s == "" {
@@ -309,6 +309,6 @@ func normalizeChannelEvents(raw interface{}) (map[string]bool, error) {
 		}
 		return out, nil
 	default:
-		return nil, errors.New("events must be object or string array")
+		return nil, constant.NotificationEventsErr
 	}
 }

src/controller/admin/order_controller.go

@@ -2,7 +2,6 @@ package admin
 
 import (
 	"encoding/csv"
-	"errors"
 	"fmt"
 	"net/http"
 	"strconv"
@@ -13,15 +12,11 @@ import (
 	"github.com/GMWalletApp/epusdt/model/mdb"
 	"github.com/GMWalletApp/epusdt/model/request"
 	"github.com/GMWalletApp/epusdt/model/service"
+	"github.com/GMWalletApp/epusdt/util/constant"
 	"github.com/GMWalletApp/epusdt/util/log"
 	"github.com/labstack/echo/v4"
 )
 
-// MarkPaidRequest is the payload for manually marking an order as paid.
-type MarkPaidRequest struct {
-	BlockTransactionId string `json:"block_transaction_id" validate:"required" example:"0xabc123def456..."`
-}
-
 // OrderListResponse wraps the paginated order list.
 type OrderListResponse struct {
 	List     []mdb.Orders `json:"list"`
@@ -93,7 +88,7 @@ func (c *BaseAdminController) GetOrder(ctx echo.Context) error {
 		return c.FailJson(ctx, err)
 	}
 	if order.ID == 0 {
-		return c.FailJson(ctx, errors.New("order not found"))
+		return c.FailJson(ctx, constant.OrderNotExists)
 	}
 	return c.SucJson(ctx, order)
 }
@@ -115,20 +110,28 @@ func (c *BaseAdminController) CloseOrder(ctx echo.Context) error {
 		return c.FailJson(ctx, err)
 	}
 	if order.ID == 0 {
-		return c.FailJson(ctx, errors.New("order not found"))
+		return c.FailJson(ctx, constant.OrderNotExists)
 	}
-	if order.Status != mdb.StatusWaitPay {
+	if order.Status != mdb.StatusWaitPay && order.Status != mdb.StatusWaitSelect {
-		return c.FailJson(ctx, errors.New("order is not waiting payment"))
+		return c.FailJson(ctx, constant.OrderNotWaitPay)
 	}
 	ok, err := data.CloseOrderManually(tradeID)
 	if err != nil {
 		return c.FailJson(ctx, err)
 	}
 	if !ok {
-		return c.FailJson(ctx, errors.New("close failed (concurrent state change)"))
+		return c.FailJson(ctx, constant.OrderStatusConflict)
 	}
-	// Release the transaction lock so the amount slot becomes reusable.
+	// Release only concrete on-chain locks. Placeholder orders and provider-only
+	// orders do not reserve a local wallet amount.
+	if order.Status == mdb.StatusWaitPay &&
+		(strings.TrimSpace(order.PayProvider) == "" || order.PayProvider == mdb.PaymentProviderOnChain) &&
+		strings.TrimSpace(order.Network) != "" &&
+		strings.TrimSpace(order.ReceiveAddress) != "" &&
+		strings.TrimSpace(order.Token) != "" &&
+		order.ActualAmount > 0 {
 		_ = data.UnLockTransaction(order.Network, order.ReceiveAddress, order.Token, order.ActualAmount)
+	}
 	return c.SucJson(ctx, nil)
 }
 
@@ -137,68 +140,35 @@ func (c *BaseAdminController) CloseOrder(ctx echo.Context) error {
 // callback + notification fire normally.
 // @Summary      Mark order paid
 // @Description  Manually mark a waiting order as paid (operator补单)
+// @Description  TON accepts canonical ton:<receive_raw>:<lt>:<hash>, lt:hash, or a unique recent hash-only reference for the order receive address.
 // @Tags         Admin Orders
 // @Security     AdminJWT
 // @Accept       json
 // @Produce      json
 // @Param        trade_id path string true "Trade ID"
-// @Param        request body admin.MarkPaidRequest true "Block transaction ID"
+// @Param        request body request.ManualPaymentRequest true "Block transaction ID"
 // @Success      200 {object} response.ApiResponse
 // @Failure      400 {object} response.ApiResponse
 // @Router       /admin/api/v1/orders/{trade_id}/mark-paid [post]
 func (c *BaseAdminController) MarkOrderPaid(ctx echo.Context) error {
 	tradeID := ctx.Param("trade_id")
 	adminUserID := currentAdminUserID(ctx)
-	req := new(MarkPaidRequest)
+	req := new(request.ManualPaymentRequest)
 	if err := ctx.Bind(req); err != nil {
 		log.Sugar.Warnf("[admin-order] mark-paid bind failed admin_user_id=%d trade_id=%s err=%v", adminUserID, tradeID, err)
-		return c.FailJson(ctx, err)
+		return c.FailJson(ctx, constant.ParamsMarshalErr)
 	}
 	req.BlockTransactionId = strings.TrimSpace(req.BlockTransactionId)
 	if err := c.ValidateStruct(ctx, req); err != nil {
 		log.Sugar.Warnf("[admin-order] mark-paid validation failed admin_user_id=%d trade_id=%s block_transaction_id=%s err=%v", adminUserID, tradeID, req.BlockTransactionId, err)
 		return c.FailJson(ctx, err)
 	}
-	order, err := data.GetOrderInfoByTradeId(tradeID)
+	resp, err := service.SubmitManualPayment(tradeID, req.BlockTransactionId)
 	if err != nil {
-		log.Sugar.Warnf("[admin-order] mark-paid load failed admin_user_id=%d trade_id=%s block_transaction_id=%s err=%v", adminUserID, tradeID, req.BlockTransactionId, err)
+		log.Sugar.Warnf("[admin-order] mark-paid failed admin_user_id=%d trade_id=%s block_transaction_id=%s err=%v", adminUserID, tradeID, req.BlockTransactionId, err)
 		return c.FailJson(ctx, err)
 	}
-	if order.ID == 0 {
+	log.Sugar.Infof("[admin-order] mark-paid success admin_user_id=%d trade_id=%s block_transaction_id=%s", adminUserID, tradeID, resp.BlockTransactionId)
-		err = errors.New("order not found")
-		log.Sugar.Warnf("[admin-order] mark-paid rejected admin_user_id=%d trade_id=%s block_transaction_id=%s err=%v", adminUserID, tradeID, req.BlockTransactionId, err)
-		return c.FailJson(ctx, err)
-	}
-	if order.Status != mdb.StatusWaitPay {
-		err = errors.New("order is not waiting payment")
-		log.Sugar.Warnf("[admin-order] mark-paid rejected admin_user_id=%d trade_id=%s status=%d block_transaction_id=%s err=%v", adminUserID, tradeID, order.Status, req.BlockTransactionId, err)
-		return c.FailJson(ctx, err)
-	}
-	if !isOnChainOrder(order.PayProvider) {
-		err = errors.New("order is not an on-chain payment order")
-		log.Sugar.Warnf("[admin-order] mark-paid rejected admin_user_id=%d trade_id=%s pay_provider=%s block_transaction_id=%s err=%v", adminUserID, tradeID, order.PayProvider, req.BlockTransactionId, err)
-		return c.FailJson(ctx, err)
-	}
-	verifiedBlockTransactionID, err := service.ValidateManualOrderPayment(order, req.BlockTransactionId)
-	if err != nil {
-		log.Sugar.Warnf("[admin-order] mark-paid chain verification failed admin_user_id=%d trade_id=%s network=%s token=%s amount=%.8f block_transaction_id=%s err=%v", adminUserID, tradeID, order.Network, order.Token, order.ActualAmount, req.BlockTransactionId, err)
-		return c.FailJson(ctx, err)
-	}
-	req.BlockTransactionId = verifiedBlockTransactionID
-	err = service.OrderProcessing(&request.OrderProcessingRequest{
-		ReceiveAddress:     order.ReceiveAddress,
-		Currency:           order.Currency,
-		Token:              order.Token,
-		Network:            order.Network,
-		Amount:             order.ActualAmount,
-		TradeId:            order.TradeId,
-		BlockTransactionId: req.BlockTransactionId,
-	})
-	if err != nil {
-		log.Sugar.Warnf("[admin-order] mark-paid processing failed admin_user_id=%d trade_id=%s block_transaction_id=%s err=%v", adminUserID, tradeID, req.BlockTransactionId, err)
-		return c.FailJson(ctx, err)
-	}
-	log.Sugar.Infof("[admin-order] mark-paid success admin_user_id=%d trade_id=%s block_transaction_id=%s", adminUserID, tradeID, req.BlockTransactionId)
 	return c.SucJson(ctx, nil)
 }
 
@@ -223,17 +193,17 @@ func (c *BaseAdminController) ResendCallback(ctx echo.Context) error {
 		return c.FailJson(ctx, err)
 	}
 	if order.ID == 0 {
-		err = errors.New("order not found")
+		err = constant.OrderNotExists
 		log.Sugar.Warnf("[admin-order] resend-callback rejected admin_user_id=%d trade_id=%s err=%v", adminUserID, tradeID, err)
 		return c.FailJson(ctx, err)
 	}
 	if order.Status != mdb.StatusPaySuccess {
-		err = errors.New("order is not paid (callback not applicable)")
+		err = constant.OrderCallbackNotApplicable
 		log.Sugar.Warnf("[admin-order] resend-callback rejected admin_user_id=%d trade_id=%s status=%d err=%v", adminUserID, tradeID, order.Status, err)
 		return c.FailJson(ctx, err)
 	}
 	if strings.TrimSpace(order.NotifyUrl) == "" {
-		err = errors.New("order has empty notify_url")
+		err = constant.OrderNotifyURLEmptyErr
 		log.Sugar.Warnf("[admin-order] resend-callback rejected admin_user_id=%d trade_id=%s err=%v", adminUserID, tradeID, err)
 		return c.FailJson(ctx, err)
 	}
@@ -243,7 +213,7 @@ func (c *BaseAdminController) ResendCallback(ctx echo.Context) error {
 		return c.FailJson(ctx, err)
 	}
 	if !ok {
-		err = errors.New("resend callback failed (concurrent state change)")
+		err = constant.OrderResendCallbackErr
 		log.Sugar.Warnf("[admin-order] resend-callback rejected admin_user_id=%d trade_id=%s err=%v", adminUserID, tradeID, err)
 		return c.FailJson(ctx, err)
 	}
@@ -251,11 +221,6 @@ func (c *BaseAdminController) ResendCallback(ctx echo.Context) error {
 	return c.SucJson(ctx, nil)
 }
 
-func isOnChainOrder(payProvider string) bool {
-	payProvider = strings.TrimSpace(payProvider)
-	return payProvider == "" || payProvider == mdb.PaymentProviderOnChain
-}
-
 // ExportOrders streams matching orders as CSV. No pagination — the
 // caller drives what rows to include via filter params. Capped at
 // 10k rows to keep the response bounded.
@@ -433,7 +398,7 @@ func (c *BaseAdminController) GetOrderWithSub(ctx echo.Context) error {
 		return c.FailJson(ctx, err)
 	}
 	if order.ID == 0 {
-		return c.FailJson(ctx, errors.New("order not found"))
+		return c.FailJson(ctx, constant.OrderNotExists)
 	}
 	subOrders, err := data.GetAllSubOrders(tradeID)
 	if err != nil {

src/controller/admin/rpc_controller.go

@@ -1,13 +1,14 @@
 package admin
 
 import (
-	"errors"
+	"net/url"
 	"strconv"
 	"strings"
 
 	"github.com/GMWalletApp/epusdt/model/data"
 	"github.com/GMWalletApp/epusdt/model/mdb"
 	"github.com/GMWalletApp/epusdt/task"
+	"github.com/GMWalletApp/epusdt/util/constant"
 	"github.com/labstack/echo/v4"
 )
 
@@ -15,11 +16,13 @@ import (
 type CreateRpcNodeRequest struct {
 	Network string `json:"network" validate:"required" example:"tron"`
 	Url     string `json:"url" validate:"required" example:"https://api.trongrid.io"`
-	// 连接类型 http=HTTP请求 ws=WebSocket长连接
+	// 连接类型 http=HTTP请求 ws=WebSocket长连接 lite=TON liteserver配置
-	Type string `json:"type" validate:"required|in:http,ws" enums:"http,ws" example:"http"`
+	Type    string `json:"type" validate:"required|in:http,ws,lite" enums:"http,ws,lite" example:"http"`
 	Weight  int    `json:"weight" example:"1"`
 	ApiKey  string `json:"api_key" example:""`
 	Enabled *bool  `json:"enabled" example:"true"`
+	// 用途 general=通用 manual_verify=补单专用 both=通用+补单
+	Purpose string `json:"purpose" enums:"general,manual_verify,both" example:"general"`
 }
 
 // UpdateRpcNodeRequest is the payload for updating an RPC node.
@@ -28,6 +31,7 @@ type UpdateRpcNodeRequest struct {
 	Weight  *int    `json:"weight" example:"1"`
 	ApiKey  *string `json:"api_key" example:"your-api-key"`
 	Enabled *bool   `json:"enabled" example:"true"`
+	Purpose *string `json:"purpose" enums:"general,manual_verify,both" example:"manual_verify"`
 }
 
 // ListRpcNodes returns rows optionally filtered by network.
@@ -64,7 +68,7 @@ func (c *BaseAdminController) ListRpcNodes(ctx echo.Context) error {
 func (c *BaseAdminController) CreateRpcNode(ctx echo.Context) error {
 	req := new(CreateRpcNodeRequest)
 	if err := ctx.Bind(req); err != nil {
-		return c.FailJson(ctx, err)
+		return c.FailJson(ctx, constant.ParamsMarshalErr)
 	}
 	if err := c.ValidateStruct(ctx, req); err != nil {
 		return c.FailJson(ctx, err)
@@ -77,13 +81,23 @@ func (c *BaseAdminController) CreateRpcNode(ctx echo.Context) error {
 	if req.Enabled != nil {
 		enabled = *req.Enabled
 	}
+	purpose, err := rpcNodePurposeFromRequest(req.Purpose)
+	if err != nil {
+		return c.FailJson(ctx, err)
+	}
+	nodeURL := strings.TrimSpace(req.Url)
+	nodeType := strings.ToLower(strings.TrimSpace(req.Type))
+	if err := validateRpcNodeURLForType(nodeURL, nodeType); err != nil {
+		return c.FailJson(ctx, err)
+	}
 	row := &mdb.RpcNode{
 		Network:       strings.ToLower(strings.TrimSpace(req.Network)),
-		Url:           strings.TrimSpace(req.Url),
+		Url:           nodeURL,
-		Type:          strings.ToLower(strings.TrimSpace(req.Type)),
+		Type:          nodeType,
 		Weight:        weight,
 		ApiKey:        req.ApiKey,
 		Enabled:       enabled,
+		Purpose:       purpose,
 		Status:        mdb.RpcNodeStatusUnknown,
 		LastLatencyMs: -1,
 	}
@@ -93,7 +107,7 @@ func (c *BaseAdminController) CreateRpcNode(ctx echo.Context) error {
 	return c.SucJson(ctx, row)
 }
 
-// UpdateRpcNode patches url/weight/api_key/enabled.
+// UpdateRpcNode patches url/weight/api_key/enabled/purpose.
 // @Summary      Update RPC node
 // @Description  Patch RPC node fields
 // @Tags         Admin RPC Nodes
@@ -108,15 +122,26 @@ func (c *BaseAdminController) CreateRpcNode(ctx echo.Context) error {
 func (c *BaseAdminController) UpdateRpcNode(ctx echo.Context) error {
 	id, err := strconv.ParseUint(ctx.Param("id"), 10, 64)
 	if err != nil {
-		return c.FailJson(ctx, err)
+		return c.FailJson(ctx, constant.ParamsMarshalErr)
 	}
 	req := new(UpdateRpcNodeRequest)
 	if err := ctx.Bind(req); err != nil {
-		return c.FailJson(ctx, err)
+		return c.FailJson(ctx, constant.ParamsMarshalErr)
 	}
 	fields := map[string]interface{}{}
 	if req.Url != nil {
-		fields["url"] = *req.Url
+		row, err := data.GetRpcNodeByID(id)
+		if err != nil {
+			return c.FailJson(ctx, err)
+		}
+		if row.ID == 0 {
+			return c.FailJson(ctx, constant.RpcNodeNotFoundErr)
+		}
+		nodeURL := strings.TrimSpace(*req.Url)
+		if err := validateRpcNodeURLForType(nodeURL, row.Type); err != nil {
+			return c.FailJson(ctx, err)
+		}
+		fields["url"] = nodeURL
 	}
 	if req.Weight != nil {
 		fields["weight"] = *req.Weight
@@ -127,6 +152,13 @@ func (c *BaseAdminController) UpdateRpcNode(ctx echo.Context) error {
 	if req.Enabled != nil {
 		fields["enabled"] = *req.Enabled
 	}
+	if req.Purpose != nil {
+		purpose, err := rpcNodePurposeFromRequest(*req.Purpose)
+		if err != nil {
+			return c.FailJson(ctx, err)
+		}
+		fields["purpose"] = purpose
+	}
 	if err := data.UpdateRpcNodeFields(id, fields); err != nil {
 		return c.FailJson(ctx, err)
 	}
@@ -146,7 +178,7 @@ func (c *BaseAdminController) UpdateRpcNode(ctx echo.Context) error {
 func (c *BaseAdminController) DeleteRpcNode(ctx echo.Context) error {
 	id, err := strconv.ParseUint(ctx.Param("id"), 10, 64)
 	if err != nil {
-		return c.FailJson(ctx, err)
+		return c.FailJson(ctx, constant.ParamsMarshalErr)
 	}
 	if err := data.DeleteRpcNodeByID(id); err != nil {
 		return c.FailJson(ctx, err)
@@ -155,9 +187,8 @@ func (c *BaseAdminController) DeleteRpcNode(ctx echo.Context) error {
 }
 
 // HealthCheckRpcNode performs an on-demand probe and writes the result.
-// For HTTP endpoints this is a GET to the URL with a short timeout; for
+// For HTTP/WS/lite endpoints this is a TCP-level check against the configured
-// WS we just attempt a TCP-level check via the same HTTP client (the
+// URL host. TON lite rows usually point to a global.config.json HTTPS URL.
-// handshake URL resolves the host identically).
 // @Summary      Health check RPC node
 // @Description  Perform an on-demand health probe on an RPC node
 // @Tags         Admin RPC Nodes
@@ -170,14 +201,14 @@ func (c *BaseAdminController) DeleteRpcNode(ctx echo.Context) error {
 func (c *BaseAdminController) HealthCheckRpcNode(ctx echo.Context) error {
 	id, err := strconv.ParseUint(ctx.Param("id"), 10, 64)
 	if err != nil {
-		return c.FailJson(ctx, err)
+		return c.FailJson(ctx, constant.ParamsMarshalErr)
 	}
 	row, err := data.GetRpcNodeByID(id)
 	if err != nil {
 		return c.FailJson(ctx, err)
 	}
 	if row.ID == 0 {
-		return c.FailJson(ctx, errors.New("node not found"))
+		return c.FailJson(ctx, constant.RpcNodeNotFoundErr)
 	}
 	status, latency := task.ProbeNode(row.Url)
 	if err := data.UpdateRpcNodeHealth(id, status, latency); err != nil {
@@ -188,3 +219,45 @@ func (c *BaseAdminController) HealthCheckRpcNode(ctx echo.Context) error {
 		"last_latency_ms": latency,
 	})
 }
+
+func rpcNodePurposeFromRequest(raw string) (string, error) {
+	purpose := strings.ToLower(strings.TrimSpace(raw))
+	if purpose == "" {
+		return mdb.RpcNodePurposeGeneral, nil
+	}
+	switch purpose {
+	case mdb.RpcNodePurposeGeneral, mdb.RpcNodePurposeManualVerify, mdb.RpcNodePurposeBoth:
+		return purpose, nil
+	default:
+		return "", constant.RpcNodePurposeErr
+	}
+}
+
+func validateRpcNodeURLForType(rawURL string, nodeType string) error {
+	rawURL = strings.TrimSpace(rawURL)
+	nodeType = strings.ToLower(strings.TrimSpace(nodeType))
+	parsed, err := url.Parse(rawURL)
+	if err != nil || parsed.Scheme == "" || parsed.Host == "" {
+		return constant.RpcNodeURLErr
+	}
+	scheme := strings.ToLower(parsed.Scheme)
+	switch nodeType {
+	case mdb.RpcNodeTypeHttp:
+		if scheme == "http" || scheme == "https" {
+			return nil
+		}
+		return constant.RpcNodeHTTPURLErr
+	case mdb.RpcNodeTypeWs:
+		if scheme == "ws" || scheme == "wss" {
+			return nil
+		}
+		return constant.RpcNodeWebSocketURLErr
+	case mdb.RpcNodeTypeLite:
+		if scheme == "http" || scheme == "https" {
+			return nil
+		}
+		return constant.RpcNodeHTTPURLErr
+	default:
+		return constant.RpcNodeTypeErr
+	}
+}

src/controller/admin/settings_controller.go

@@ -1,6 +1,7 @@
 package admin
 
 import (
+	"encoding/json"
 	"fmt"
 	"strconv"
 	"strings"
@@ -9,6 +10,9 @@ import (
 	"github.com/GMWalletApp/epusdt/model/data"
 	"github.com/GMWalletApp/epusdt/model/mdb"
 	"github.com/GMWalletApp/epusdt/telegram"
+	"github.com/GMWalletApp/epusdt/util/constant"
+	appLog "github.com/GMWalletApp/epusdt/util/log"
+	"github.com/GMWalletApp/epusdt/util/security"
 	"github.com/labstack/echo/v4"
 )
 
@@ -16,15 +20,15 @@ import (
 // Supported groups and keys:
 //
 //   - group=rate:
-//     rate.forced_usdt_rate  (float)  — override USDT/CNY when > 0; <= 0 uses rate.api_url
+//     rate.forced_rate_list  (json)   — override rate map, e.g. {"cny":{"usdt":0.14635,"ton":0.5}}; base/coin keys are normalized to lowercase
-//     rate.api_url           (string) — external rate API URL used when rate.forced_usdt_rate <= 0
+//     rate.api_url           (string) — external rate API URL used when no positive forced rate exists
 //     rate.adjust_percent    (float)  — rate adjustment percentage
 //     rate.okx_c2c_enabled   (bool)   — use OKX C2C rate feed
 //
 //   - group=epay:
-//     epay.default_token     (string) — token for EPAY orders, e.g. "usdt" (default)
+//     epay.default_token     (string) — default token for EPAY submit.php, e.g. "usdt"; empty allows status=4 placeholders when request token/network are also absent
-//     epay.default_currency  (string) — fiat currency for EPAY orders, e.g. "cny" (default)
+//     epay.default_currency  (string) — default fiat currency for EPAY submit.php, e.g. "cny"; empty falls back to cny
-//     epay.default_network   (string) — blockchain network for EPAY orders, e.g. "tron" (default)
+//     epay.default_network   (string) — default network for EPAY submit.php, e.g. "tron" or "ton"; empty allows status=4 placeholders when request token/network are also absent
 //
 //   - group=okpay:
 //     okpay.enabled          (bool)   — enable OkPay as a switch-network payment option
@@ -51,10 +55,11 @@ import (
 //   - group=system:
 //     system.order_expiration_time (int) — order expiry in minutes
 //     system.amount_precision      (int) — payment amount precision, 2-6 decimals (default 2)
+//     system.log_level             (string) — runtime log level: debug, info, warn, error (default error)
 type SettingUpsertItem struct {
 	Group string      `json:"group" enums:"brand,rate,system,epay,okpay" example:"epay"`
 	Key   string      `json:"key" example:"epay.default_network"`
-	Value string `json:"value" example:"tron"`
+	Value interface{} `json:"value"`
 	Type  string      `json:"type" enums:"string,int,bool,json" example:"string"`
 }
 
@@ -88,13 +93,13 @@ func (c *BaseAdminController) ListSettings(ctx echo.Context) error {
 // independently so a malformed row in the middle doesn't drop earlier
 // ones. Errors are returned per-key so the UI can surface them.
 // @Summary      Upsert settings
-// @Description  Batch insert/update settings. Returns per-key status.
+// @Description  Batch insert/update settings. Returns per-key status; failed items include error_code for frontend i18n.
 // @Description  Supported groups: brand, rate, system, epay, okpay.
-// @Description  epay group keys: epay.default_token (e.g. "usdt"), epay.default_currency (e.g. "cny"), epay.default_network (e.g. "tron").
+// @Description  epay group keys: epay.default_token (e.g. "usdt" or "ton", empty allows status=4 placeholders), epay.default_currency (e.g. "cny", empty falls back to cny), epay.default_network (e.g. "tron" or "ton", empty allows status=4 placeholders).
 // @Description  okpay group keys: okpay.enabled, okpay.shop_id, okpay.shop_token, okpay.api_url, okpay.callback_url, okpay.return_url, okpay.timeout_seconds, okpay.allow_tokens.
-// @Description  rate group keys: rate.forced_usdt_rate (>0 overrides USDT/CNY; <=0 uses rate.api_url), rate.api_url, rate.adjust_percent, rate.okx_c2c_enabled.
+// @Description  rate group keys: rate.forced_rate_list (JSON map, e.g. {"cny":{"usdt":0.14635,"ton":0.5}}; base/coin keys are normalized to lowercase), rate.api_url, rate.adjust_percent, rate.okx_c2c_enabled.
 // @Description  brand group keys: brand.checkout_name, brand.logo_url, brand.site_title, brand.success_copy, brand.support_url, brand.background_color, brand.background_image_url. Legacy aliases brand.site_name, brand.page_title and brand.pay_success_text are also supported.
-// @Description  system group keys: system.order_expiration_time, system.amount_precision (int, 2-6, default 2).
+// @Description  system group keys: system.order_expiration_time, system.amount_precision (int, 2-6, default 2), system.log_level (debug|info|warn|error, default error).
 // @Tags         Admin Settings
 // @Security     AdminJWT
 // @Accept       json
@@ -106,7 +111,7 @@ func (c *BaseAdminController) ListSettings(ctx echo.Context) error {
 func (c *BaseAdminController) UpsertSettings(ctx echo.Context) error {
 	req := new(SettingsUpsertRequest)
 	if err := ctx.Bind(req); err != nil {
-		return c.FailJson(ctx, err)
+		return c.FailJson(ctx, constant.ParamsMarshalErr)
 	}
 	if err := c.ValidateStruct(ctx, req); err != nil {
 		return c.FailJson(ctx, err)
@@ -114,27 +119,52 @@ func (c *BaseAdminController) UpsertSettings(ctx echo.Context) error {
 	type result struct {
 		Key       string `json:"key"`
 		OK        bool   `json:"ok"`
+		ErrorCode int    `json:"error_code,omitempty"`
 		Error     string `json:"error,omitempty"`
 	}
 	out := make([]result, 0, len(req.Items))
+	errorResult := func(key string, err error) result {
+		code, msg := constant.ResolveErrno(err)
+		return result{Key: key, OK: false, ErrorCode: code, Error: msg}
+	}
 	for _, item := range req.Items {
 		key := strings.TrimSpace(item.Key)
 		if key == "" {
-			out = append(out, result{Key: item.Key, OK: false, Error: "key required"})
+			out = append(out, errorResult(item.Key, constant.SettingItemErr))
 			continue
 		}
-		if err := validateSettingItem(item.Group, key, item.Value); err != nil {
+		value, err := normalizeSettingValue(item.Value)
-			out = append(out, result{Key: key, OK: false, Error: err.Error()})
+		if err != nil {
+			out = append(out, errorResult(key, constant.SettingItemErr))
+			continue
+		}
+		value, err = normalizeAndValidateSettingItem(item.Group, key, value)
+		if err != nil {
+			out = append(out, errorResult(key, constant.SettingItemErr))
 			continue
 		}
 		if key == mdb.SettingKeyAmountPrecision {
 			item.Group = mdb.SettingGroupSystem
 			item.Type = mdb.SettingTypeInt
 		}
-		if err := data.SetSetting(item.Group, key, item.Value, item.Type); err != nil {
+		if key == mdb.SettingKeyRateForcedRateList {
-			out = append(out, result{Key: key, OK: false, Error: err.Error()})
+			item.Group = mdb.SettingGroupRate
+			item.Type = mdb.SettingTypeJSON
+		}
+		if key == mdb.SettingKeySystemLogLevel {
+			item.Group = mdb.SettingGroupSystem
+			item.Type = mdb.SettingTypeString
+		}
+		if err := data.SetSetting(item.Group, key, value, item.Type); err != nil {
+			out = append(out, errorResult(key, err))
 			continue
 		}
+		if key == mdb.SettingKeySystemLogLevel {
+			if err := appLog.SetLevel(value); err != nil {
+				out = append(out, errorResult(key, err))
+				continue
+			}
+		}
 		out = append(out, result{Key: key, OK: true})
 	}
 
@@ -159,27 +189,113 @@ func (c *BaseAdminController) UpsertSettings(ctx echo.Context) error {
 	return c.SucJson(ctx, out)
 }
 
-func validateSettingItem(group, key, value string) error {
+func normalizeSettingValue(value interface{}) (string, error) {
+	switch v := value.(type) {
+	case nil:
+		return "", nil
+	case string:
+		return v, nil
+	default:
+		b, err := json.Marshal(v)
+		if err != nil {
+			return "", fmt.Errorf("value must be JSON serializable")
+		}
+		return string(b), nil
+	}
+}
+
+func normalizeAndValidateSettingItem(group, key, value string) (string, error) {
 	switch key {
 	case mdb.SettingKeyAmountPrecision:
 		if strings.ToLower(strings.TrimSpace(group)) != mdb.SettingGroupSystem {
-			return fmt.Errorf("%s must use group %s", key, mdb.SettingGroupSystem)
+			return value, fmt.Errorf("%s must use group %s", key, mdb.SettingGroupSystem)
 		}
 		precision, err := strconv.Atoi(strings.TrimSpace(value))
 		if err != nil {
-			return fmt.Errorf("%s must be an integer", key)
+			return value, fmt.Errorf("%s must be an integer", key)
 		}
 		if precision < data.MinAmountPrecision || precision > data.MaxAmountPrecision {
-			return fmt.Errorf("%s must be between %d and %d", key, data.MinAmountPrecision, data.MaxAmountPrecision)
+			return value, fmt.Errorf("%s must be between %d and %d", key, data.MinAmountPrecision, data.MaxAmountPrecision)
+		}
+	case mdb.SettingKeyRateForcedRateList:
+		normalized, err := normalizeForcedRateListSetting(group, key, value)
+		if err != nil {
+			return value, err
+		}
+		return normalized, nil
+	case mdb.SettingKeyRateApiUrl:
+		if strings.ToLower(strings.TrimSpace(group)) != mdb.SettingGroupRate {
+			return value, fmt.Errorf("%s must use group %s", key, mdb.SettingGroupRate)
+		}
+		if err := security.ValidatePublicHTTPURL(value); err != nil {
+			return value, fmt.Errorf("%s invalid: %w", key, err)
+		}
+	case mdb.SettingKeySystemLogLevel:
+		if strings.ToLower(strings.TrimSpace(group)) != mdb.SettingGroupSystem {
+			return value, fmt.Errorf("%s must use group %s", key, mdb.SettingGroupSystem)
+		}
+		normalized, err := appLog.NormalizeLevel(value)
+		if err != nil {
+			return value, err
+		}
+		return normalized, nil
+	}
+	return value, nil
+}
+
+func normalizeForcedRateListSetting(group, key, value string) (string, error) {
+	if strings.ToLower(strings.TrimSpace(group)) != mdb.SettingGroupRate {
+		return value, fmt.Errorf("%s must use group %s", key, mdb.SettingGroupRate)
+	}
+	if strings.TrimSpace(value) == "" {
+		return "", nil
+	}
+
+	var rates map[string]map[string]float64
+	if err := json.Unmarshal([]byte(value), &rates); err != nil {
+		return value, fmt.Errorf("%s must be valid JSON object", key)
+	}
+
+	normalized := make(map[string]map[string]float64, len(rates))
+	for base, coins := range rates {
+		normalizedBase := strings.ToLower(strings.TrimSpace(base))
+		if normalizedBase == "" {
+			return value, fmt.Errorf("%s base currency must not be empty", key)
+		}
+		if coins == nil {
+			return value, fmt.Errorf("%s.%s must be an object", key, base)
+		}
+		normalizedCoins, ok := normalized[normalizedBase]
+		if !ok {
+			normalizedCoins = make(map[string]float64, len(coins))
+			normalized[normalizedBase] = normalizedCoins
+		}
+		for coin, rate := range coins {
+			normalizedCoin := strings.ToLower(strings.TrimSpace(coin))
+			if normalizedCoin == "" {
+				return value, fmt.Errorf("%s coin must not be empty", key)
+			}
+			if rate < 0 {
+				return value, fmt.Errorf("%s.%s.%s must be >= 0", key, base, coin)
+			}
+			if _, exists := normalizedCoins[normalizedCoin]; exists {
+				return value, fmt.Errorf("%s.%s.%s is duplicated after normalization", key, normalizedBase, normalizedCoin)
+			}
+			normalizedCoins[normalizedCoin] = rate
 		}
 	}
-	return nil
+
+	normalizedValue, err := json.Marshal(normalized)
+	if err != nil {
+		return value, fmt.Errorf("%s must be JSON serializable", key)
+	}
+	return string(normalizedValue), nil
 }
 
 // DeleteSetting removes one row. The next read of that key will fall
 // back to the hardcoded default (see settings_data.GetSetting*).
 // @Summary      Delete setting
-// @Description  Remove a setting by key (falls back to default)
+// @Description  Remove a setting by key (falls back to default). Deleting system.log_level immediately resets runtime logging to error.
 // @Tags         Admin Settings
 // @Security     AdminJWT
 // @Produce      json
@@ -195,9 +311,10 @@ func (c *BaseAdminController) DeleteSetting(ctx echo.Context) error {
 	if err := data.DeleteSetting(key); err != nil {
 		return c.FailJson(ctx, err)
 	}
+	if key == mdb.SettingKeySystemLogLevel {
+		if err := appLog.SetLevel(mdb.SettingDefaultSystemLogLevel); err != nil {
+			return c.FailJson(ctx, err)
+		}
+	}
 	return c.SucJson(ctx, nil)
 }
-
-// Public helper for the rate/usdt overrides — used by config package to
-// read settings-backed values without importing the controller package.
-var _ = mdb.SettingKeyRateForcedUsdt // ensure key constants remain referenced

src/controller/admin/wallet_controller.go

@@ -1,13 +1,13 @@
 package admin
 
 import (
-	"errors"
 	"strconv"
 	"strings"
 
 	"github.com/GMWalletApp/epusdt/model/dao"
 	"github.com/GMWalletApp/epusdt/model/data"
 	"github.com/GMWalletApp/epusdt/model/mdb"
+	"github.com/GMWalletApp/epusdt/util/constant"
 	"github.com/labstack/echo/v4"
 )
 
@@ -105,7 +105,7 @@ func (c *BaseAdminController) AdminListWallets(ctx echo.Context) error {
 func (c *BaseAdminController) AdminAddWallet(ctx echo.Context) error {
 	req := new(AdminAddWalletRequest)
 	if err := ctx.Bind(req); err != nil {
-		return c.FailJson(ctx, err)
+		return c.FailJson(ctx, constant.ParamsMarshalErr)
 	}
 	if err := c.ValidateStruct(ctx, req); err != nil {
 		return c.FailJson(ctx, err)
@@ -140,14 +140,14 @@ func (c *BaseAdminController) AdminAddWallet(ctx echo.Context) error {
 func (c *BaseAdminController) AdminGetWallet(ctx echo.Context) error {
 	id, err := strconv.ParseUint(ctx.Param("id"), 10, 64)
 	if err != nil {
-		return c.FailJson(ctx, err)
+		return c.FailJson(ctx, constant.ParamsMarshalErr)
 	}
 	wallet, err := data.GetWalletAddressById(id)
 	if err != nil {
 		return c.FailJson(ctx, err)
 	}
 	if wallet.ID == 0 {
-		return c.FailJson(ctx, errors.New("wallet not found"))
+		return c.FailJson(ctx, constant.WalletNotFoundErr)
 	}
 	counts, _ := data.CountOrdersByAddress()
 	return c.SucJson(ctx, WalletListItem{WalletAddress: *wallet, OrderCount: counts[wallet.Address]})
@@ -168,11 +168,11 @@ func (c *BaseAdminController) AdminGetWallet(ctx echo.Context) error {
 func (c *BaseAdminController) AdminUpdateWallet(ctx echo.Context) error {
 	id, err := strconv.ParseUint(ctx.Param("id"), 10, 64)
 	if err != nil {
-		return c.FailJson(ctx, err)
+		return c.FailJson(ctx, constant.ParamsMarshalErr)
 	}
 	req := new(AdminUpdateWalletRequest)
 	if err := ctx.Bind(req); err != nil {
-		return c.FailJson(ctx, err)
+		return c.FailJson(ctx, constant.ParamsMarshalErr)
 	}
 	fields := map[string]interface{}{}
 	if req.Remark != nil {
@@ -202,11 +202,11 @@ func (c *BaseAdminController) AdminUpdateWallet(ctx echo.Context) error {
 func (c *BaseAdminController) AdminChangeWalletStatus(ctx echo.Context) error {
 	id, err := strconv.ParseUint(ctx.Param("id"), 10, 64)
 	if err != nil {
-		return c.FailJson(ctx, err)
+		return c.FailJson(ctx, constant.ParamsMarshalErr)
 	}
 	req := new(AdminChangeWalletStatusRequest)
 	if err := ctx.Bind(req); err != nil {
-		return c.FailJson(ctx, err)
+		return c.FailJson(ctx, constant.ParamsMarshalErr)
 	}
 	if err := c.ValidateStruct(ctx, req); err != nil {
 		return c.FailJson(ctx, err)
@@ -230,7 +230,7 @@ func (c *BaseAdminController) AdminChangeWalletStatus(ctx echo.Context) error {
 func (c *BaseAdminController) AdminDeleteWallet(ctx echo.Context) error {
 	id, err := strconv.ParseUint(ctx.Param("id"), 10, 64)
 	if err != nil {
-		return c.FailJson(ctx, err)
+		return c.FailJson(ctx, constant.ParamsMarshalErr)
 	}
 	if err := data.DeleteWalletAddressById(id); err != nil {
 		return c.FailJson(ctx, err)
@@ -242,7 +242,7 @@ func (c *BaseAdminController) AdminDeleteWallet(ctx echo.Context) error {
 // them all as observation wallets. Per-row failures are collected and
 // returned so the UI can surface which addresses already existed.
 // @Summary      Batch import wallets
-// @Description  Import multiple wallet addresses at once. Per-row status is returned.
+// @Description  Import multiple wallet addresses at once. Per-row status is returned; failed rows include error_code for frontend i18n.
 // @Tags         Admin Wallets
 // @Security     AdminJWT
 // @Accept       json
@@ -254,7 +254,7 @@ func (c *BaseAdminController) AdminDeleteWallet(ctx echo.Context) error {
 func (c *BaseAdminController) AdminBatchImportWallets(ctx echo.Context) error {
 	req := new(AdminBatchImportRequest)
 	if err := ctx.Bind(req); err != nil {
-		return c.FailJson(ctx, err)
+		return c.FailJson(ctx, constant.ParamsMarshalErr)
 	}
 	if err := c.ValidateStruct(ctx, req); err != nil {
 		return c.FailJson(ctx, err)
@@ -262,13 +262,15 @@ func (c *BaseAdminController) AdminBatchImportWallets(ctx echo.Context) error {
 	type result struct {
 		Address   string `json:"address"`
 		OK        bool   `json:"ok"`
+		ErrorCode int    `json:"error_code,omitempty"`
 		Error     string `json:"error,omitempty"`
 	}
 	out := make([]result, 0, len(req.Addresses))
 	for _, addr := range req.Addresses {
 		row, err := data.AddWalletAddressWithNetwork(req.Network, addr)
 		if err != nil {
-			out = append(out, result{Address: addr, OK: false, Error: err.Error()})
+			code, msg := constant.ResolveErrno(err)
+			out = append(out, result{Address: addr, OK: false, ErrorCode: code, Error: msg})
 			continue
 		}
 		_ = dao.Mdb.Model(&mdb.WalletAddress{}).Where("id = ?", row.ID).

src/controller/base.go

@@ -1,7 +1,7 @@
 package controller
 
 import (
-	"errors"
+	"github.com/GMWalletApp/epusdt/util/constant"
 	"github.com/GMWalletApp/epusdt/util/http"
 	"github.com/gookit/validate"
 	"github.com/gookit/validate/locales/zhcn"
@@ -46,6 +46,6 @@ func (c *BaseController) ValidateStruct(ctx echo.Context, i interface{}, scene .
 	if v.Validate() {
 		return nil
 	} else {
-		return errors.New(v.Errors.One())
+		return constant.ParamsMarshalErr
 	}
 }

src/controller/comm/order_controller.go

@@ -25,6 +25,8 @@ func apiKeyFromContext(ctx echo.Context) *mdb.ApiKey {
 // CreateTransaction 创建交易
 // @Summary      Create transaction
 // @Description  Create a payment transaction order. Accepts JSON body (application/json) or form-encoded body (application/x-www-form-urlencoded).
+// @Description  GMPay may omit both token and network to create a status=4 placeholder order; EPay submit.php can also create one when neither request parameters nor database defaults provide token/network. Supplying only one of token/network is invalid.
+// @Description  payment_type is optional for GMPay. If it is sent, it is a normal signed parameter and must be included when calculating signature.
 // @Tags         Payment
 // @Accept       json
 // @Accept       x-www-form-urlencoded
@@ -32,16 +34,16 @@ func apiKeyFromContext(ctx echo.Context) *mdb.ApiKey {
 // @Param        request body request.CreateTransactionRequest false "Transaction payload (JSON)"
 // @Param        order_id formData string false "Merchant order ID"
 // @Param        currency formData string false "Fiat currency (e.g. cny)"
-// @Param        token formData string false "Crypto token (e.g. usdt)"
+// @Param        token formData string false "Crypto token (e.g. TON, USDT); omit together with network to create a placeholder where supported"
-// @Param        network formData string false "Network (e.g. tron)"
+// @Param        network formData string false "Network (e.g. ton, tron); omit together with token to create a placeholder where supported"
 // @Param        amount formData number false "Amount"
 // @Param        notify_url formData string false "Callback URL"
 // @Param        signature formData string false "MD5 signature"
 // @Param        redirect_url formData string false "Redirect URL"
 // @Param        name formData string false "Order name"
-// @Param        payment_type formData string false "Payment type"
+// @Param        payment_type formData string false "Optional GMPay compatibility flag; include in signature when sent"
 // @Success      200 {object} response.ApiResponse{data=response.CreateTransactionResponse}
-// @Failure      400 {object} response.ApiResponse
+// @Failure      400 {object} response.ApiResponse "Stable errno in status_code: 10009 invalid params, 10041 invalid notify_url, 10004 invalid amount, 10014 chain disabled, 10016 unsupported asset, 10003 no wallet, 10005 no amount channel"
 // @Router       /payments/gmpay/v1/order/create-transaction [post]
 func (c *BaseCommController) CreateTransaction(ctx echo.Context) (err error) {
 	req := new(request.CreateTransactionRequest)
@@ -58,17 +60,18 @@ func (c *BaseCommController) CreateTransaction(ctx echo.Context) (err error) {
 	return c.SucJson(ctx, resp)
 }
 
-// SwitchNetwork 切换支付网络，创建或返回子订单
+// SwitchNetwork 切换支付网络，补全占位父单或创建/返回子订单
 // @Summary      Switch payment network
-// @Description  Switch to a different payment target, creating or returning a sub-order.
+// @Description  Switch to a different payment target. A status=4 placeholder is completed in place and returns the same parent trade_id with is_selected=false; an already concrete status=1 parent creates or returns the only sub-order when switching to a different target.
-// @Description  Normal values such as tron/solana/ethereum create on-chain child orders.
+// @Description  Normal values such as ton/tron/solana/ethereum select on-chain payment; the special value okpay selects OkPay hosted payment.
-// @Description  The special value okpay creates or reuses an OkPay-hosted child order and returns its payment_url.
+// @Description  For status=4 placeholders from GMPay or EPay submit.php, both on-chain targets and okpay complete the parent in place without creating a child order. Sub-orders cannot be switched again.
+// @Description  For EPay orders with a merchant return_url, the returned redirect_url is the internal /pay/return/{trade_id} hop rather than the raw merchant return_url.
 // @Tags         Payment
 // @Accept       json
 // @Produce      json
 // @Param        request body request.SwitchNetworkRequest true "Switch network payload"
 // @Success      200 {object} response.ApiResponse{data=response.CheckoutCounterResponse}
-// @Failure      400 {object} response.ApiResponse
+// @Failure      400 {object} response.ApiResponse "Stable errno in status_code: 10008 order not found, 10011 sub-order limit, 10012 cannot switch sub-order, 10013 not waiting payment, 10016 unsupported asset, 10017/10018/10019 provider errors, 10042 provider order creation failed"
 // @Router       /pay/switch-network [post]
 func (c *BaseCommController) SwitchNetwork(ctx echo.Context) (err error) {
 	req := new(request.SwitchNetworkRequest)
@@ -85,7 +88,7 @@ func (c *BaseCommController) SwitchNetwork(ctx echo.Context) (err error) {
 
 	jsonBytes, err := json.MarshalIndent(resp, "", "  ")
 	if err != nil {
-		return c.FailJson(ctx, err)
+		return c.FailJson(ctx, constant.SystemErr)
 	}
 
 	log.Sugar.Debugf("switch network response: \n%s", string(jsonBytes))
@@ -98,7 +101,7 @@ func (c *BaseCommController) SwitchNetwork(ctx echo.Context) (err error) {
 // POST (form) per the legacy EPAY protocol; swagger documents POST as
 // the canonical form — the GET variant is identical save the transport.
 // @Summary      Create transaction and redirect (EPAY compat)
-// @Description  Legacy EPAY-style endpoint. Accepts GET (querystring) and POST (form). On success, 302 redirects to /pay/checkout-counter/{trade_id}. Signature uses MD5 of sorted params + secret_key of the api_keys row matching the submitted pid.
+// @Description  Legacy EPAY-style endpoint. Accepts GET (querystring) and POST (form). On success, 302 redirects to /pay/checkout-counter/{trade_id}. Signature uses MD5 of sorted params + secret_key of the api_keys row matching the submitted pid. Optional request token/network/currency override database defaults and must be included in the EPay signature when sent. The server injects internal payment_type=Epay after EPay signature verification; merchants do not send GMPay payment_type to this endpoint.
 // @Tags         Payment
 // @Accept       x-www-form-urlencoded
 // @Produce      html
@@ -121,7 +124,7 @@ func (c *BaseCommController) SwitchNetwork(ctx echo.Context) (err error) {
 // @Param        sign formData string true "MD5 signature"
 // @Param        sign_type formData string false "Signature type (MD5)"
 // @Success      302 "Redirect to checkout counter"
-// @Failure      400 {object} response.ApiResponse
+// @Failure      400 {object} response.ApiResponse "Stable errno in status_code: 10009 invalid params, 10041 invalid notify_url, 10004 invalid amount, 10014 chain disabled, 10016 unsupported asset, 10003 no wallet, 10005 no amount channel"
 // @Router       /payments/epay/v1/order/create-transaction/submit.php [post]
 // @Router       /payments/epay/v1/order/create-transaction/submit.php [get]
 func (c *BaseCommController) CreateTransactionAndRedirect(ctx echo.Context) (err error) {

src/controller/comm/pay_controller.go

@@ -1,14 +1,21 @@
 package comm
 
 import (
+	"net/http"
+	"strings"
+
+	"github.com/GMWalletApp/epusdt/model/request"
 	"github.com/GMWalletApp/epusdt/model/response"
 	"github.com/GMWalletApp/epusdt/model/service"
+	"github.com/GMWalletApp/epusdt/util/constant"
 	"github.com/labstack/echo/v4"
 )
 
 // CheckoutCounter 收银台
 // @Summary      Checkout counter page
-// @Description  Return checkout initialization data when the order exists. This endpoint only confirms order existence and returns base order data; call /pay/check-status/{trade_id} for the current order status (1=waiting payment, 2=paid, 3=expired).
+// @Description  Return checkout initialization data when the order exists. This endpoint only confirms order existence and returns base order data; call /pay/check-status/{trade_id} for the current order status (1=waiting payment, 2=paid, 3=expired, 4=waiting token/network selection).
+// @Description  When status=4, actual_amount is 0 and token/network/receive_address are empty; this state is produced by GMPay placeholders or EPay submit.php when no token/network request values or database defaults exist. The cashier should guide the payer to choose an on-chain token/network or OkPay and then call /pay/switch-network.
+// @Description  For EPay orders with a merchant return_url, the response redirect_url is rewritten to the internal /pay/return/{trade_id} hop; the database still stores the merchant's raw return_url.
 // @Tags         Payment
 // @Produce      json
 // @Param        trade_id path string true "Trade ID"
@@ -25,9 +32,32 @@ func (c *BaseCommController) CheckoutCounter(ctx echo.Context) (err error) {
 	return c.SucJson(ctx, resp)
 }
 
+// ReturnToMerchant performs the browser-facing EPay success return hop.
+// Non-EPay or not-yet-paid orders are sent back to the checkout counter.
+// @Summary      Return to merchant (EPAY compat)
+// @Description  Browser-facing success return hop for EPay orders. Paid EPay orders are redirected to the merchant return_url with signed legacy EPay query params. Orders that are not EPay or not yet paid are redirected back to the checkout counter.
+// @Description  This route also returns explicit business errors when the merchant return_url is missing, the order API key is unavailable, or EPay signature construction fails.
+// @Tags         Payment
+// @Produce      html
+// @Param        trade_id path string true "Trade ID"
+// @Success      302 "Redirect to merchant return_url or checkout counter"
+// @Failure      400 {object} response.ApiResponse "Stable errno in status_code: 10008 order not found, 10044 invalid order redirect url, 10045 order api key unavailable, 10046 failed to build epay return signature"
+// @Router       /pay/return/{trade_id} [get]
+func (c *BaseCommController) ReturnToMerchant(ctx echo.Context) error {
+	tradeID := ctx.Param("trade_id")
+	redirect, err := service.ResolveEPayReturnRedirect(tradeID)
+	if err != nil {
+		return c.FailJson(ctx, err)
+	}
+	if redirect.IsMerchantRedirect {
+		ctx.Response().Header().Set("Cache-Control", "no-store")
+	}
+	return ctx.Redirect(http.StatusFound, redirect.TargetURL)
+}
+
 // CheckStatus 支付状态检测
 // @Summary      Check payment status
-// @Description  Return the current order status by trade ID. Status: 1=waiting payment, 2=paid, 3=expired.
+// @Description  Return the current order status by trade ID. Status: 1=waiting payment, 2=paid, 3=expired, 4=waiting token/network selection.
 // @Tags         Payment
 // @Produce      json
 // @Param        trade_id path string true "Trade ID"
@@ -46,3 +76,33 @@ func (c *BaseCommController) CheckStatus(ctx echo.Context) (err error) {
 	}
 	return c.SucJson(ctx, resp)
 }
+
+// SubmitTxHash 手动提交交易 hash 补单
+// @Summary      Submit transaction hash
+// @Description  Submit an on-chain transaction hash from the cashier. The hash is verified against the order and, when valid, the same manual payment processing path used by admin mark-paid is executed. OkPay/provider orders are not supported.
+// @Description  TON accepts canonical ton:<receive_raw>:<lt>:<hash>, lt:hash, or a unique recent hash-only reference for the order receive address.
+// @Tags         Payment
+// @Accept       json
+// @Produce      json
+// @Param        trade_id path string true "Trade ID"
+// @Param        request body request.ManualPaymentRequest true "Transaction hash payload"
+// @Success      200 {object} response.ApiResponse{data=response.ManualPaymentResponse}
+// @Failure      400 {object} response.ApiResponse "Stable errno in status_code: 10008 order not found, 10009 invalid params, 10013 not waiting payment, 10038 verification failed, 10039 unsupported provider, 10007 hash already processed"
+// @Router       /pay/submit-tx-hash/{trade_id} [post]
+func (c *BaseCommController) SubmitTxHash(ctx echo.Context) (err error) {
+	tradeId := ctx.Param("trade_id")
+	req := new(request.ManualPaymentRequest)
+	if err = ctx.Bind(req); err != nil {
+		return c.FailJson(ctx, constant.ParamsMarshalErr)
+	}
+	req.BlockTransactionId = strings.TrimSpace(req.BlockTransactionId)
+	if err = c.ValidateStruct(ctx, req); err != nil {
+		return c.FailJson(ctx, err)
+	}
+
+	resp, err := service.SubmitCashierManualPayment(tradeId, req.BlockTransactionId)
+	if err != nil {
+		return c.FailJson(ctx, err)
+	}
+	return c.SucJson(ctx, resp)
+}

src/controller/comm/supported_asset_controller.go

@@ -5,6 +5,7 @@ import (
 	"strconv"
 	"strings"
 
+	"github.com/GMWalletApp/epusdt/config"
 	"github.com/GMWalletApp/epusdt/middleware"
 	"github.com/GMWalletApp/epusdt/model/data"
 	"github.com/GMWalletApp/epusdt/model/mdb"
@@ -108,11 +109,12 @@ func (c *BaseCommController) GetPublicConfig(ctx echo.Context) error {
 			BackgroundImageURL: data.GetBrandBackgroundImageURL(),
 		},
 		Epay: response.EpayPublicConfig{
-			DefaultToken:    data.GetSettingString(mdb.SettingKeyEpayDefaultToken, "usdt"),
+			DefaultToken:    data.GetSettingString(mdb.SettingKeyEpayDefaultToken, ""),
 			DefaultCurrency: data.GetSettingString(mdb.SettingKeyEpayDefaultCurrency, "cny"),
-			DefaultNetwork:  data.GetSettingString(mdb.SettingKeyEpayDefaultNetwork, "tron"),
+			DefaultNetwork:  data.GetSettingString(mdb.SettingKeyEpayDefaultNetwork, ""),
 		},
 		OkPay:   okpay,
+		Version: config.GetAppVersion(),
 	})
 }
 

src/go.mod

@@ -23,6 +23,7 @@ require (
 	github.com/spf13/cobra v1.9.1
 	github.com/spf13/viper v1.20.1
 	github.com/tidwall/gjson v1.18.0
+	github.com/xssnick/tonutils-go v1.16.0
 	go.uber.org/zap v1.27.0
 	golang.org/x/crypto v0.48.0
 	gopkg.in/telebot.v3 v3.0.0

src/go.sum

@@ -348,6 +348,8 @@ github.com/xo/terminfo v0.0.0-20210125001918-ca9a967f8778 h1:QldyIu/L63oPpyvQmHg
 github.com/xo/terminfo v0.0.0-20210125001918-ca9a967f8778/go.mod h1:2MuV+tbUrU1zIOPMxZ5EncGwgmMJsa+9ucAQZXxsObs=
 github.com/xrash/smetrics v0.0.0-20240521201337-686a1a2994c1 h1:gEOO8jv9F4OT7lGCjxCBTO/36wtF6j2nSip77qHd4x4=
 github.com/xrash/smetrics v0.0.0-20240521201337-686a1a2994c1/go.mod h1:Ohn+xnUBiLI6FVj/9LpzZWtj1/D6lUovWYBkxHVV3aM=
+github.com/xssnick/tonutils-go v1.16.0 h1:MLYVZiiMB0Q+XudLo7WyjOli4gMuenNmJpBqETqa5DE=
+github.com/xssnick/tonutils-go v1.16.0/go.mod h1:CNSM+L0FYufOFhprg8otc9Y/ecFfLrWqFMq00Gh9yk4=
 github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 go.mongodb.org/mongo-driver v1.17.3 h1:TQyXhnsWfWtgAhMtOgtYHMTkZIfBTpMTsMnd9ZBeHxQ=

src/internal/testutil/testdb.go

@@ -12,6 +12,7 @@ import (
 	"github.com/spf13/viper"
 	"go.uber.org/zap"
 	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
 	"gorm.io/gorm/logger"
 	"gorm.io/gorm/schema"
 )
@@ -65,11 +66,19 @@ func SetupTestDatabases(t testing.TB) func() {
 	// Seed all standard chains as enabled so IsChainEnabled checks pass.
 	for _, network := range []string{
 		mdb.NetworkTron, mdb.NetworkSolana, mdb.NetworkEthereum,
-		mdb.NetworkBsc, mdb.NetworkPolygon, mdb.NetworkPlasma,
+		mdb.NetworkBsc, mdb.NetworkPolygon, mdb.NetworkPlasma, mdb.NetworkTon,
 	} {
 		mainDB.Create(&mdb.Chain{Network: network, Enabled: true})
 	}
 
+	mainDB.Clauses(clause.OnConflict{DoNothing: true}).Create(&[]mdb.ChainToken{
+		{Network: mdb.NetworkTron, Symbol: "USDT", ContractAddress: "TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t", Decimals: 6, Enabled: true},
+		{Network: mdb.NetworkEthereum, Symbol: "USDT", ContractAddress: "0xdAC17F958D2ee523a2206206994597C13D831ec7", Decimals: 6, Enabled: true},
+		{Network: mdb.NetworkBsc, Symbol: "USDT", ContractAddress: "0x55d398326f99059fF775485246999027B3197955", Decimals: 18, Enabled: true},
+		{Network: mdb.NetworkTon, Symbol: "TON", ContractAddress: "", Decimals: 9, Enabled: true},
+		{Network: mdb.NetworkTon, Symbol: "USDT", ContractAddress: "0:b113a994b5024a16719f69139328eb759596c38a25f59028b146fecdc3621dfe", Decimals: 6, Enabled: true},
+	})
+
 	// Seed two universal api_keys rows. Both usable for EPAY/GMPAY
 	// flows; the numeric PID 1001 row lets legacy tests that submit
 	// `pid=1001` still match.
@@ -85,11 +94,11 @@ func SetupTestDatabases(t testing.TB) func() {
 	})
 	if err := dao.Mdb.Create(&mdb.Setting{
 		Group: "rate",
-		Key:   "rate.forced_usdt_rate",
+		Key:   "rate.forced_rate_list",
-		Value: "1.0",
+		Value: `{"cny":{"usdt":1}}`,
-		Type:  "string",
+		Type:  "json",
 	}).Error; err != nil {
-		t.Fatalf("seed rate.forced_usdt_rate: %v", err)
+		t.Fatalf("seed rate.forced_rate_list: %v", err)
 	}
 
 	return func() {

src/middleware/check_jwt.go

@@ -27,16 +27,9 @@ const (
 func CheckAdminJWT() echo.MiddlewareFunc {
 	return func(next echo.HandlerFunc) echo.HandlerFunc {
 		return func(ctx echo.Context) error {
-			raw := strings.TrimSpace(ctx.Request().Header.Get("Authorization"))
+			token, err := adminTokenFromAuthorization(ctx.Request().Header.Get("Authorization"))
-			if raw == "" {
+			if err != nil {
-				return echo.NewHTTPError(http.StatusUnauthorized, "missing authorization header")
+				return err
-			}
-			if !strings.HasPrefix(raw, "Bearer ") {
-				return echo.NewHTTPError(http.StatusUnauthorized, "authorization header must use Bearer scheme")
-			}
-			token := strings.TrimSpace(raw[len("Bearer "):])
-			if token == "" {
-				return echo.NewHTTPError(http.StatusUnauthorized, "empty token")
 			}
 			claims, err := appjwt.Parse(token)
 			if err != nil {
@@ -48,3 +41,23 @@ func CheckAdminJWT() echo.MiddlewareFunc {
 		}
 	}
 }
+
+func adminTokenFromAuthorization(header string) (string, error) {
+	raw := strings.TrimSpace(header)
+	if raw == "" {
+		return "", echo.NewHTTPError(http.StatusUnauthorized, "missing authorization header")
+	}
+
+	const bearerPrefix = "Bearer "
+	token := raw
+	if strings.HasPrefix(raw, bearerPrefix) {
+		token = strings.TrimSpace(raw[len(bearerPrefix):])
+	} else if raw == strings.TrimSpace(bearerPrefix) {
+		token = ""
+	}
+
+	if token == "" {
+		return "", echo.NewHTTPError(http.StatusUnauthorized, "empty token")
+	}
+	return token, nil
+}

src/middleware/check_jwt_test.go

@@ -0,0 +1,118 @@
+package middleware
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/GMWalletApp/epusdt/internal/testutil"
+	"github.com/GMWalletApp/epusdt/model/data"
+	"github.com/GMWalletApp/epusdt/model/mdb"
+	appjwt "github.com/GMWalletApp/epusdt/util/jwt"
+	"github.com/labstack/echo/v4"
+)
+
+func TestAdminTokenFromAuthorization(t *testing.T) {
+	tests := []struct {
+		name    string
+		header  string
+		want    string
+		wantErr bool
+	}{
+		{
+			name:   "bearer token",
+			header: "Bearer jwt-token",
+			want:   "jwt-token",
+		},
+		{
+			name:   "bare token",
+			header: "jwt-token",
+			want:   "jwt-token",
+		},
+		{
+			name:   "trimmed bare token",
+			header: "  jwt-token  ",
+			want:   "jwt-token",
+		},
+		{
+			name:    "missing header",
+			header:  "",
+			wantErr: true,
+		},
+		{
+			name:    "empty bearer token",
+			header:  "Bearer ",
+			wantErr: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := adminTokenFromAuthorization(tt.header)
+			if tt.wantErr {
+				if err == nil {
+					t.Fatal("expected error")
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+			if got != tt.want {
+				t.Fatalf("token = %q, want %q", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestCheckAdminJWTAcceptsBearerAndBareTokens(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+
+	if err := data.SetSetting(mdb.SettingGroupSystem, mdb.SettingKeyJwtSecret, "test-jwt-secret", mdb.SettingTypeString); err != nil {
+		t.Fatalf("seed jwt secret: %v", err)
+	}
+	token, err := appjwt.Sign(42, "admin")
+	if err != nil {
+		t.Fatalf("sign jwt: %v", err)
+	}
+
+	tests := []struct {
+		name   string
+		header string
+	}{
+		{
+			name:   "bearer token",
+			header: "Bearer " + token,
+		},
+		{
+			name:   "bare token",
+			header: token,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			e := echo.New()
+			e.Use(CheckAdminJWT())
+			e.GET("/", func(ctx echo.Context) error {
+				if got := ctx.Get(AdminUserIDKey); got != uint64(42) {
+					t.Fatalf("%s = %v, want 42", AdminUserIDKey, got)
+				}
+				if got := ctx.Get(AdminUsernameKey); got != "admin" {
+					t.Fatalf("%s = %v, want admin", AdminUsernameKey, got)
+				}
+				return ctx.NoContent(http.StatusNoContent)
+			})
+
+			req := httptest.NewRequest(http.MethodGet, "/", nil)
+			req.Header.Set(echo.HeaderAuthorization, tt.header)
+			rec := httptest.NewRecorder()
+			e.ServeHTTP(rec, req)
+
+			if rec.Code != http.StatusNoContent {
+				t.Fatalf("status = %d, want %d; body=%s", rec.Code, http.StatusNoContent, rec.Body.String())
+			}
+		})
+	}
+}

src/model/dao/mdb_table_init.go

@@ -46,6 +46,7 @@ func MdbTableInit() {
 		}
 
 		seedChains()
+		backfillRpcNodePurpose()
 		seedRpcNodes()
 		seedChainTokens()
 		seedDefaultSettings()
@@ -63,6 +64,7 @@ func seedChains() {
 		{Network: mdb.NetworkBsc, DisplayName: "BSC", Enabled: true, MinConfirmations: 3, ScanIntervalSec: 5},
 		{Network: mdb.NetworkPolygon, DisplayName: "Polygon", Enabled: true, MinConfirmations: 3, ScanIntervalSec: 5},
 		{Network: mdb.NetworkPlasma, DisplayName: "Plasma", Enabled: true, MinConfirmations: 1, ScanIntervalSec: 5},
+		{Network: mdb.NetworkTon, DisplayName: "TON", Enabled: true, MinConfirmations: 1, ScanIntervalSec: 5},
 	}
 	if err := Mdb.Clauses(clause.OnConflict{DoNothing: true}).Create(&defaults).Error; err != nil {
 		color.Red.Printf("[store_db] seed chains err=%s\n", err)
@@ -97,6 +99,9 @@ func seedChainTokens() {
 		{Network: mdb.NetworkPolygon, Symbol: "USDC.e", ContractAddress: "0x2791Bca1f2de4661ED88A30C99A7a9449Aa84174", Decimals: 6, Enabled: true},
 		// Plasma
 		{Network: mdb.NetworkPlasma, Symbol: "USDT", ContractAddress: "0xB8CE59FC3717ada4C02eaDF9682A9e934F625ebb", Decimals: 6, Enabled: true},
+		// TON
+		{Network: mdb.NetworkTon, Symbol: "TON", ContractAddress: "", Decimals: 9, Enabled: true},
+		{Network: mdb.NetworkTon, Symbol: "USDT", ContractAddress: "0:b113a994b5024a16719f69139328eb759596c38a25f59028b146fecdc3621dfe", Decimals: 6, Enabled: true},
 	}
 	if err := Mdb.Clauses(clause.OnConflict{DoNothing: true}).Create(&defaults).Error; err != nil {
 		color.Red.Printf("[store_db] seed chain_tokens err=%s\n", err)
@@ -106,14 +111,7 @@ func seedChainTokens() {
 // seedRpcNodes inserts default RPC endpoints for each chain. Checks per
 // (network, url) so re-runs are idempotent and admin edits persist.
 func seedRpcNodes() {
-	defaults := []mdb.RpcNode{
+	defaults := defaultRpcNodes()
-		{Network: mdb.NetworkTron, Url: "https://api.trongrid.io", Type: mdb.RpcNodeTypeHttp, Weight: 1, Enabled: true, Status: mdb.RpcNodeStatusUnknown},
-		{Network: mdb.NetworkEthereum, Url: "wss://ethereum.publicnode.com", Type: mdb.RpcNodeTypeWs, Weight: 1, Enabled: true, Status: mdb.RpcNodeStatusUnknown},
-		{Network: mdb.NetworkSolana, Url: "https://api.mainnet-beta.solana.com", Type: mdb.RpcNodeTypeHttp, Weight: 1, Enabled: true, Status: mdb.RpcNodeStatusUnknown},
-		{Network: mdb.NetworkBsc, Url: "wss://bsc.drpc.org", Type: mdb.RpcNodeTypeWs, Weight: 1, Enabled: true, Status: mdb.RpcNodeStatusUnknown},
-		{Network: mdb.NetworkPolygon, Url: "wss://polygon-bor-rpc.publicnode.com", Type: mdb.RpcNodeTypeWs, Weight: 1, Enabled: true, Status: mdb.RpcNodeStatusUnknown},
-		{Network: mdb.NetworkPlasma, Url: "wss://rpc.plasma.to", Type: mdb.RpcNodeTypeWs, Weight: 1, Enabled: true, Status: mdb.RpcNodeStatusUnknown},
-	}
 	for _, d := range defaults {
 		var count int64
 		if err := Mdb.Model(&mdb.RpcNode{}).
@@ -131,6 +129,30 @@ func seedRpcNodes() {
 	}
 }
 
+func defaultRpcNodes() []mdb.RpcNode {
+	defaults := []mdb.RpcNode{
+		{Network: mdb.NetworkTron, Url: "https://api.trongrid.io", Type: mdb.RpcNodeTypeHttp, Weight: 1, Enabled: true, Purpose: mdb.RpcNodePurposeGeneral, Status: mdb.RpcNodeStatusUnknown},
+		{Network: mdb.NetworkEthereum, Url: "wss://ethereum.publicnode.com", Type: mdb.RpcNodeTypeWs, Weight: 1, Enabled: true, Purpose: mdb.RpcNodePurposeGeneral, Status: mdb.RpcNodeStatusUnknown},
+		{Network: mdb.NetworkSolana, Url: "https://api.mainnet-beta.solana.com", Type: mdb.RpcNodeTypeHttp, Weight: 1, Enabled: true, Purpose: mdb.RpcNodePurposeGeneral, Status: mdb.RpcNodeStatusUnknown},
+		{Network: mdb.NetworkBsc, Url: "wss://bsc.drpc.org", Type: mdb.RpcNodeTypeWs, Weight: 1, Enabled: true, Purpose: mdb.RpcNodePurposeGeneral, Status: mdb.RpcNodeStatusUnknown},
+		{Network: mdb.NetworkPolygon, Url: "wss://polygon-bor-rpc.publicnode.com", Type: mdb.RpcNodeTypeWs, Weight: 1, Enabled: true, Purpose: mdb.RpcNodePurposeGeneral, Status: mdb.RpcNodeStatusUnknown},
+		{Network: mdb.NetworkPlasma, Url: "wss://rpc.plasma.to", Type: mdb.RpcNodeTypeWs, Weight: 1, Enabled: true, Purpose: mdb.RpcNodePurposeGeneral, Status: mdb.RpcNodeStatusUnknown},
+		{Network: mdb.NetworkTon, Url: "https://ton-blockchain.github.io/global.config.json", Type: mdb.RpcNodeTypeLite, Weight: 1, Enabled: true, Purpose: mdb.RpcNodePurposeGeneral, Status: mdb.RpcNodeStatusUnknown},
+		{Network: mdb.NetworkEthereum, Url: "https://rpc.epusdt.com/ethereum", Type: mdb.RpcNodeTypeHttp, Weight: 1, Enabled: true, Purpose: mdb.RpcNodePurposeManualVerify, Status: mdb.RpcNodeStatusUnknown},
+		{Network: mdb.NetworkBsc, Url: "https://rpc.epusdt.com/binance", Type: mdb.RpcNodeTypeHttp, Weight: 1, Enabled: true, Purpose: mdb.RpcNodePurposeManualVerify, Status: mdb.RpcNodeStatusUnknown},
+		{Network: mdb.NetworkPolygon, Url: "https://rpc.epusdt.com/polygon", Type: mdb.RpcNodeTypeHttp, Weight: 1, Enabled: true, Purpose: mdb.RpcNodePurposeManualVerify, Status: mdb.RpcNodeStatusUnknown},
+	}
+	return defaults
+}
+
+func backfillRpcNodePurpose() {
+	if err := Mdb.Model(&mdb.RpcNode{}).
+		Where("purpose = '' OR purpose IS NULL").
+		Update("purpose", mdb.RpcNodePurposeGeneral).Error; err != nil {
+		color.Red.Printf("[store_db] backfill rpc_nodes purpose err=%s\n", err)
+	}
+}
+
 // seedDefaultSettings inserts built-in default settings.
 // Uses ON CONFLICT DO NOTHING so admin edits persist across restarts.
 func seedDefaultSettings() {
@@ -140,9 +162,10 @@ func seedDefaultSettings() {
 	}
 	defaults := []mdb.Setting{
 		{Group: mdb.SettingGroupSystem, Key: mdb.SettingKeyAmountPrecision, Value: "2", Type: mdb.SettingTypeInt},
-		{Group: mdb.SettingGroupEpay, Key: mdb.SettingKeyEpayDefaultToken, Value: "usdt", Type: mdb.SettingTypeString},
+		{Group: mdb.SettingGroupSystem, Key: mdb.SettingKeySystemLogLevel, Value: mdb.SettingDefaultSystemLogLevel, Type: mdb.SettingTypeString},
+		{Group: mdb.SettingGroupEpay, Key: mdb.SettingKeyEpayDefaultToken, Value: "", Type: mdb.SettingTypeString},
 		{Group: mdb.SettingGroupEpay, Key: mdb.SettingKeyEpayDefaultCurrency, Value: "cny", Type: mdb.SettingTypeString},
-		{Group: mdb.SettingGroupEpay, Key: mdb.SettingKeyEpayDefaultNetwork, Value: "tron", Type: mdb.SettingTypeString},
+		{Group: mdb.SettingGroupEpay, Key: mdb.SettingKeyEpayDefaultNetwork, Value: "", Type: mdb.SettingTypeString},
 		{Group: mdb.SettingGroupOkPay, Key: mdb.SettingKeyOkPayEnabled, Value: "false", Type: mdb.SettingTypeBool},
 		{Group: mdb.SettingGroupOkPay, Key: mdb.SettingKeyOkPayAPIURL, Value: "https://api.okaypay.me/shop/", Type: mdb.SettingTypeString},
 		{Group: mdb.SettingGroupOkPay, Key: mdb.SettingKeyOkPayCallbackURL, Value: okPayCallbackURL, Type: mdb.SettingTypeString},

src/model/dao/mdb_table_init_test.go

@@ -0,0 +1,196 @@
+package dao
+
+import (
+	"path/filepath"
+	"testing"
+
+	"github.com/GMWalletApp/epusdt/model/mdb"
+	"github.com/libtnb/sqlite"
+	"github.com/spf13/viper"
+	"gorm.io/gorm"
+)
+
+func TestDefaultRpcNodesIncludesManualVerifyEpusdtEvmNodes(t *testing.T) {
+	want := map[string]string{
+		mdb.NetworkEthereum: "https://rpc.epusdt.com/ethereum",
+		mdb.NetworkBsc:      "https://rpc.epusdt.com/binance",
+		mdb.NetworkPolygon:  "https://rpc.epusdt.com/polygon",
+	}
+	got := make(map[string]mdb.RpcNode)
+	for _, node := range defaultRpcNodes() {
+		if node.Purpose != mdb.RpcNodePurposeManualVerify {
+			continue
+		}
+		if _, ok := want[node.Network]; ok {
+			got[node.Network] = node
+		}
+	}
+
+	for network, url := range want {
+		node, ok := got[network]
+		if !ok {
+			t.Fatalf("missing manual_verify seed rpc node for %s", network)
+		}
+		if node.Url != url {
+			t.Fatalf("%s manual_verify seed url = %q, want %q", network, node.Url, url)
+		}
+		if node.Type != mdb.RpcNodeTypeHttp {
+			t.Fatalf("%s manual_verify seed type = %q, want %q", network, node.Type, mdb.RpcNodeTypeHttp)
+		}
+		if !node.Enabled {
+			t.Fatalf("%s manual_verify seed enabled = false, want true", network)
+		}
+		if node.Status != mdb.RpcNodeStatusUnknown {
+			t.Fatalf("%s manual_verify seed status = %q, want %q", network, node.Status, mdb.RpcNodeStatusUnknown)
+		}
+	}
+}
+
+func TestDefaultRpcNodesIncludesTonLiteGeneralNode(t *testing.T) {
+	var got *mdb.RpcNode
+	nodes := defaultRpcNodes()
+	for i := range nodes {
+		node := nodes[i]
+		if node.Network == mdb.NetworkTon && node.Type == mdb.RpcNodeTypeLite {
+			got = &node
+			break
+		}
+	}
+
+	if got == nil {
+		t.Fatal("missing TON lite seed rpc node")
+	}
+	if got.Url != "https://ton-blockchain.github.io/global.config.json" {
+		t.Fatalf("TON lite seed url = %q", got.Url)
+	}
+	if got.Purpose != mdb.RpcNodePurposeGeneral {
+		t.Fatalf("TON lite seed purpose = %q, want %q", got.Purpose, mdb.RpcNodePurposeGeneral)
+	}
+	if !got.Enabled {
+		t.Fatal("TON lite seed enabled = false, want true")
+	}
+	if got.Status != mdb.RpcNodeStatusUnknown {
+		t.Fatalf("TON lite seed status = %q, want %q", got.Status, mdb.RpcNodeStatusUnknown)
+	}
+}
+
+func TestSeedDefaultSettingsIncludesSystemLogLevel(t *testing.T) {
+	db := setupSeedSettingsTestDB(t)
+	Mdb = db
+
+	seedDefaultSettings()
+
+	var row mdb.Setting
+	if err := Mdb.Where("`key` = ?", mdb.SettingKeySystemLogLevel).Take(&row).Error; err != nil {
+		t.Fatalf("load system.log_level seed: %v", err)
+	}
+	if row.Group != mdb.SettingGroupSystem {
+		t.Fatalf("system.log_level group = %q, want %q", row.Group, mdb.SettingGroupSystem)
+	}
+	if row.Value != mdb.SettingDefaultSystemLogLevel {
+		t.Fatalf("system.log_level value = %q, want %q", row.Value, mdb.SettingDefaultSystemLogLevel)
+	}
+	if row.Type != mdb.SettingTypeString {
+		t.Fatalf("system.log_level type = %q, want %q", row.Type, mdb.SettingTypeString)
+	}
+}
+
+func TestSeedDefaultSettingsUsesEmptyEpayTokenAndNetwork(t *testing.T) {
+	db := setupSeedSettingsTestDB(t)
+	Mdb = db
+
+	seedDefaultSettings()
+
+	rows := make(map[string]mdb.Setting)
+	for _, key := range []string{
+		mdb.SettingKeyEpayDefaultToken,
+		mdb.SettingKeyEpayDefaultCurrency,
+		mdb.SettingKeyEpayDefaultNetwork,
+	} {
+		var row mdb.Setting
+		if err := Mdb.Where("`key` = ?", key).Take(&row).Error; err != nil {
+			t.Fatalf("load %s seed: %v", key, err)
+		}
+		rows[key] = row
+	}
+	if rows[mdb.SettingKeyEpayDefaultToken].Value != "" {
+		t.Fatalf("epay.default_token seed = %q, want empty", rows[mdb.SettingKeyEpayDefaultToken].Value)
+	}
+	if rows[mdb.SettingKeyEpayDefaultNetwork].Value != "" {
+		t.Fatalf("epay.default_network seed = %q, want empty", rows[mdb.SettingKeyEpayDefaultNetwork].Value)
+	}
+	if rows[mdb.SettingKeyEpayDefaultCurrency].Value != "cny" {
+		t.Fatalf("epay.default_currency seed = %q, want cny", rows[mdb.SettingKeyEpayDefaultCurrency].Value)
+	}
+}
+
+func TestSeedDefaultSettingsDoesNotOverwriteExistingEpayDefaults(t *testing.T) {
+	db := setupSeedSettingsTestDB(t)
+	Mdb = db
+	for _, row := range []mdb.Setting{
+		{Group: mdb.SettingGroupEpay, Key: mdb.SettingKeyEpayDefaultToken, Value: "usdt", Type: mdb.SettingTypeString},
+		{Group: mdb.SettingGroupEpay, Key: mdb.SettingKeyEpayDefaultNetwork, Value: "tron", Type: mdb.SettingTypeString},
+	} {
+		if err := Mdb.Create(&row).Error; err != nil {
+			t.Fatalf("precreate %s: %v", row.Key, err)
+		}
+	}
+
+	seedDefaultSettings()
+
+	for key, want := range map[string]string{
+		mdb.SettingKeyEpayDefaultToken:   "usdt",
+		mdb.SettingKeyEpayDefaultNetwork: "tron",
+	} {
+		var row mdb.Setting
+		if err := Mdb.Where("`key` = ?", key).Take(&row).Error; err != nil {
+			t.Fatalf("load %s seed: %v", key, err)
+		}
+		if row.Value != want {
+			t.Fatalf("%s value = %q, want existing %q", key, row.Value, want)
+		}
+	}
+}
+
+func TestSeedDefaultSettingsDoesNotOverwriteSystemLogLevel(t *testing.T) {
+	db := setupSeedSettingsTestDB(t)
+	Mdb = db
+	if err := Mdb.Create(&mdb.Setting{
+		Group: mdb.SettingGroupSystem,
+		Key:   mdb.SettingKeySystemLogLevel,
+		Value: "debug",
+		Type:  mdb.SettingTypeString,
+	}).Error; err != nil {
+		t.Fatalf("precreate system.log_level: %v", err)
+	}
+
+	seedDefaultSettings()
+
+	var row mdb.Setting
+	if err := Mdb.Where("`key` = ?", mdb.SettingKeySystemLogLevel).Take(&row).Error; err != nil {
+		t.Fatalf("load system.log_level seed: %v", err)
+	}
+	if row.Value != "debug" {
+		t.Fatalf("system.log_level value = %q, want existing debug", row.Value)
+	}
+}
+
+func setupSeedSettingsTestDB(t *testing.T) *gorm.DB {
+	t.Helper()
+	oldDB := Mdb
+	viper.Reset()
+	viper.Set("app_uri", "https://example.com")
+	t.Cleanup(func() {
+		Mdb = oldDB
+		viper.Reset()
+	})
+
+	db, err := gorm.Open(sqlite.Open(filepath.Join(t.TempDir(), "seed-settings.db")), &gorm.Config{})
+	if err != nil {
+		t.Fatalf("open sqlite: %v", err)
+	}
+	if err := db.AutoMigrate(&mdb.Setting{}); err != nil {
+		t.Fatalf("migrate settings: %v", err)
+	}
+	return db
+}

src/model/data/admin_user_data.go

@@ -40,6 +40,9 @@ type InitialAdminPasswordHashInfo struct {
 // can print it to the console. Idempotent — subsequent calls return
 // ("", false, nil).
 func EnsureDefaultAdmin() (password string, created bool, err error) {
+	if err := purgeDeletedInitialAdminPasswordPlain(); err != nil {
+		return "", false, err
+	}
 	var count int64
 	if err := dao.Mdb.Model(&mdb.AdminUser{}).Count(&count).Error; err != nil {
 		return "", false, err
@@ -68,6 +71,12 @@ func EnsureDefaultAdmin() (password string, created bool, err error) {
 	return password, true, nil
 }
 
+func purgeDeletedInitialAdminPasswordPlain() error {
+	return dao.Mdb.Unscoped().
+		Where("`key` = ? AND deleted_at IS NOT NULL", mdb.SettingKeyInitAdminPasswordPlain).
+		Delete(&mdb.Setting{}).Error
+}
+
 func randomAdminPassword() string {
 	b := make([]byte, 16)
 	_, _ = rand.Read(b)
@@ -121,9 +130,11 @@ func initAdminPasswordState(plain string) error {
 }
 
 func upsertSettingRow(tx *gorm.DB, row mdb.Setting) error {
+	updates := clause.AssignmentColumns([]string{"group", "value", "type", "description", "updated_at"})
+	updates = append(updates, clause.Assignment{Column: clause.Column{Name: "deleted_at"}, Value: nil})
 	return tx.Clauses(clause.OnConflict{
 		Columns:   []clause.Column{{Name: "key"}},
-		DoUpdates: clause.AssignmentColumns([]string{"group", "value", "type", "description", "updated_at"}),
+		DoUpdates: updates,
 	}).Create(&row).Error
 }
 
@@ -154,7 +165,7 @@ func ConsumeInitialAdminPassword() (string, error) {
 			return ErrInitAdminPasswordUnavailable
 		}
 		password = row.Value
-		res := tx.Where("`key` = ?", mdb.SettingKeyInitAdminPasswordPlain).Delete(&mdb.Setting{})
+		res := tx.Unscoped().Where("`key` = ?", mdb.SettingKeyInitAdminPasswordPlain).Delete(&mdb.Setting{})
 		if res.Error != nil {
 			return res.Error
 		}

src/model/data/admin_user_data_test.go

@@ -0,0 +1,122 @@
+package data
+
+import (
+	"testing"
+
+	"github.com/GMWalletApp/epusdt/internal/testutil"
+	"github.com/GMWalletApp/epusdt/model/dao"
+	"github.com/GMWalletApp/epusdt/model/mdb"
+)
+
+func TestUpsertSettingRowRestoresSoftDeletedSetting(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+
+	row := mdb.Setting{
+		Group: mdb.SettingGroupSystem,
+		Key:   mdb.SettingKeyInitAdminPasswordChanged,
+		Value: "false",
+		Type:  mdb.SettingTypeBool,
+	}
+	if err := upsertSettingRow(dao.Mdb, row); err != nil {
+		t.Fatalf("seed setting: %v", err)
+	}
+	if err := dao.Mdb.Where("`key` = ?", row.Key).Delete(&mdb.Setting{}).Error; err != nil {
+		t.Fatalf("delete setting: %v", err)
+	}
+
+	row.Value = "true"
+	if err := upsertSettingRow(dao.Mdb, row); err != nil {
+		t.Fatalf("restore setting: %v", err)
+	}
+
+	var restored mdb.Setting
+	if err := dao.Mdb.Where("`key` = ?", row.Key).Take(&restored).Error; err != nil {
+		t.Fatalf("load restored setting: %v", err)
+	}
+	if restored.Value != "true" {
+		t.Fatalf("restored value = %q, want true", restored.Value)
+	}
+	if restored.DeletedAt.Valid {
+		t.Fatalf("restored setting still has deleted_at=%v", restored.DeletedAt)
+	}
+}
+
+func TestConsumeInitialAdminPasswordHardDeletesPlaintext(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+
+	const password = "init-pass-plain"
+	if err := initAdminPasswordState(password); err != nil {
+		t.Fatalf("seed initial password state: %v", err)
+	}
+
+	got, err := ConsumeInitialAdminPassword()
+	if err != nil {
+		t.Fatalf("consume initial password: %v", err)
+	}
+	if got != password {
+		t.Fatalf("password = %q, want %q", got, password)
+	}
+
+	var count int64
+	if err := dao.Mdb.Unscoped().
+		Model(&mdb.Setting{}).
+		Where("`key` = ?", mdb.SettingKeyInitAdminPasswordPlain).
+		Count(&count).Error; err != nil {
+		t.Fatalf("count plaintext setting: %v", err)
+	}
+	if count != 0 {
+		t.Fatalf("plaintext setting rows after consume = %d, want 0", count)
+	}
+	if !GetSettingBool(mdb.SettingKeyInitAdminPasswordFetched, false) {
+		t.Fatal("expected fetched flag to be true")
+	}
+}
+
+func TestEnsureDefaultAdminPurgesLegacySoftDeletedPlaintext(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+
+	hash, err := HashPassword("existing-password")
+	if err != nil {
+		t.Fatalf("hash password: %v", err)
+	}
+	if err := dao.Mdb.Create(&mdb.AdminUser{
+		Username:     defaultAdminUsername,
+		PasswordHash: hash,
+		Status:       mdb.AdminUserStatusEnable,
+	}).Error; err != nil {
+		t.Fatalf("seed admin: %v", err)
+	}
+	if err := dao.Mdb.Create(&mdb.Setting{
+		Group: mdb.SettingGroupSystem,
+		Key:   mdb.SettingKeyInitAdminPasswordPlain,
+		Value: "legacy-soft-deleted-plain",
+		Type:  mdb.SettingTypeString,
+	}).Error; err != nil {
+		t.Fatalf("seed plaintext setting: %v", err)
+	}
+	if err := dao.Mdb.Where("`key` = ?", mdb.SettingKeyInitAdminPasswordPlain).Delete(&mdb.Setting{}).Error; err != nil {
+		t.Fatalf("soft delete plaintext setting: %v", err)
+	}
+
+	password, created, err := EnsureDefaultAdmin()
+	if err != nil {
+		t.Fatalf("ensure default admin: %v", err)
+	}
+	if created || password != "" {
+		t.Fatalf("created=%v password=%q, want existing admin unchanged", created, password)
+	}
+
+	var count int64
+	if err := dao.Mdb.Unscoped().
+		Model(&mdb.Setting{}).
+		Where("`key` = ?", mdb.SettingKeyInitAdminPasswordPlain).
+		Count(&count).Error; err != nil {
+		t.Fatalf("count plaintext setting: %v", err)
+	}
+	if count != 0 {
+		t.Fatalf("legacy plaintext rows after ensure = %d, want 0", count)
+	}
+}

src/model/data/order_admin_data.go

@@ -105,12 +105,12 @@ func CountOrdersByStatus() (map[int]int64, error) {
 	return out, nil
 }
 
-// CloseOrderManually transitions a pending order to expired. Only
+// CloseOrderManually transitions a pending order to expired. It covers both
-// touches rows currently in StatusWaitPay so idempotent / safe.
+// payable orders and placeholder orders waiting for token/network selection.
 func CloseOrderManually(tradeID string) (bool, error) {
 	result := dao.Mdb.Model(&mdb.Orders{}).
 		Where("trade_id = ?", tradeID).
-		Where("status = ?", mdb.StatusWaitPay).
+		Where("status IN ?", []int{mdb.StatusWaitPay, mdb.StatusWaitSelect}).
 		Update("status", mdb.StatusExpired)
 	return result.RowsAffected > 0, result.Error
 }

src/model/data/order_data.go

@@ -8,6 +8,7 @@ import (
 	"github.com/GMWalletApp/epusdt/model/dao"
 	"github.com/GMWalletApp/epusdt/model/mdb"
 	"github.com/GMWalletApp/epusdt/model/request"
+	addressutil "github.com/GMWalletApp/epusdt/util/address"
 	"github.com/dromara/carbon/v2"
 	"github.com/shopspring/decimal"
 	"gorm.io/gorm"
@@ -39,9 +40,15 @@ func normalizeLockNetwork(network string) string {
 
 func normalizeLockAddress(network, address string) string {
 	address = strings.TrimSpace(address)
-	if isEVMNetwork(normalizeLockNetwork(network)) {
+	network = normalizeLockNetwork(network)
+	if isEVMNetwork(network) {
 		return strings.ToLower(address)
 	}
+	if network == mdb.NetworkTon {
+		if raw, err := addressutil.TonRawAddressKey(address); err == nil {
+			return raw
+		}
+	}
 	return address
 }
 
@@ -202,7 +209,7 @@ func SaveCallBackOrdersResp(order *mdb.Orders) error {
 func UpdateOrderIsExpirationById(id uint64, expirationCutoff time.Time) (bool, error) {
 	result := dao.Mdb.Model(mdb.Orders{}).
 		Where("id = ?", id).
-		Where("status = ?", mdb.StatusWaitPay).
+		Where("status IN ?", []int{mdb.StatusWaitPay, mdb.StatusWaitSelect}).
 		Where("created_at <= ?", expirationCutoff).
 		Update("status", mdb.StatusExpired)
 	return result.RowsAffected > 0, result.Error
@@ -218,6 +225,15 @@ func CountActiveSubOrders(parentTradeId string) (int64, error) {
 	return count, err
 }
 
+// CountSubOrders counts all sub-orders ever created under a parent.
+func CountSubOrders(parentTradeId string) (int64, error) {
+	var count int64
+	err := dao.Mdb.Model(&mdb.Orders{}).
+		Where("parent_trade_id = ?", parentTradeId).
+		Count(&count).Error
+	return count, err
+}
+
 // GetSubOrderByTokenNetwork finds an existing active sub-order matching token+network under a parent.
 func GetSubOrderByTokenNetwork(parentTradeId string, token string, network string) (*mdb.Orders, error) {
 	order := new(mdb.Orders)
@@ -281,6 +297,61 @@ func MarkOrderSelected(tradeId string) error {
 		Update("is_selected", true).Error
 }
 
+// CompleteWaitSelectOrder fills a placeholder order with concrete chain fields
+// and makes it payable. It only updates status=WaitSelect rows so concurrent
+// switch-network attempts cannot overwrite a payable order.
+func CompleteWaitSelectOrder(tradeID string, network string, token string, receiveAddress string, actualAmount float64) (bool, error) {
+	result := dao.Mdb.Model(&mdb.Orders{}).
+		Where("trade_id = ?", tradeID).
+		Where("status = ?", mdb.StatusWaitSelect).
+		Updates(map[string]interface{}{
+			"status":          mdb.StatusWaitPay,
+			"network":         strings.ToLower(strings.TrimSpace(network)),
+			"token":           strings.ToUpper(strings.TrimSpace(token)),
+			"receive_address": receiveAddress,
+			"actual_amount":   actualAmount,
+			"is_selected":     false,
+			"created_at":      time.Now(),
+		})
+	return result.RowsAffected > 0, result.Error
+}
+
+// CompleteWaitSelectOkPayOrderWithTransaction converts a placeholder parent
+// directly into an OkPay order. It intentionally does not create a local chain
+// lock because OkPay owns the hosted payment target.
+func CompleteWaitSelectOkPayOrderWithTransaction(tx *gorm.DB, tradeID string, token string, actualAmount float64) (bool, error) {
+	result := tx.Model(&mdb.Orders{}).
+		Where("trade_id = ?", tradeID).
+		Where("status = ?", mdb.StatusWaitSelect).
+		Updates(map[string]interface{}{
+			"status":          mdb.StatusWaitPay,
+			"network":         mdb.PaymentProviderOkPay,
+			"token":           strings.ToUpper(strings.TrimSpace(token)),
+			"receive_address": "OKPAY",
+			"actual_amount":   actualAmount,
+			"is_selected":     false,
+			"pay_provider":    mdb.PaymentProviderOkPay,
+			"created_at":      time.Now(),
+		})
+	return result.RowsAffected > 0, result.Error
+}
+
+// MarkProviderSwitchParentSelectedWithTransaction marks a switch-network parent
+// as selected for a hosted payment provider. It intentionally does not fill
+// chain fields or create a transaction lock; the provider child order carries
+// the concrete payment target.
+func MarkProviderSwitchParentSelectedWithTransaction(tx *gorm.DB, tradeID string) (bool, error) {
+	result := tx.Model(&mdb.Orders{}).
+		Where("trade_id = ?", tradeID).
+		Where("status IN ?", []int{mdb.StatusWaitPay, mdb.StatusWaitSelect}).
+		Updates(map[string]interface{}{
+			"status":      mdb.StatusWaitPay,
+			"is_selected": true,
+			"created_at":  time.Now(),
+		})
+	return result.RowsAffected > 0, result.Error
+}
+
 // ExpireOrderByTradeID marks a waiting order as expired. Used to retire failed
 // child-order attempts that should not remain selectable/reusable.
 func ExpireOrderByTradeID(tradeId string) error {

src/model/data/order_data_stats.go

@@ -1,6 +1,7 @@
 package data
 
 import (
+	"fmt"
 	"time"
 
 	"github.com/GMWalletApp/epusdt/model/dao"
@@ -28,25 +29,40 @@ type AddressDailyStat struct {
 	ActualAmount float64 `json:"actual_amount"`
 }
 
+func statsBucketExpr(column string, hourly bool) (string, error) {
+	dialect := "sqlite"
+	if dao.Mdb != nil && dao.Mdb.Dialector != nil {
+		dialect = dao.Mdb.Dialector.Name()
+	}
+	return statsBucketExprForDialect(dialect, column, hourly)
+}
+
+func statsBucketExprForDialect(dialect, column string, hourly bool) (string, error) {
+	switch dialect {
+	case "sqlite", "":
+		// modernc SQLite stores time.Time as Go's time.String() by default.
+		// Prefix buckets work for that format and SQLite datetime text.
+		if hourly {
+			return fmt.Sprintf("replace(substr(%s, 1, 13), 'T', ' ') || ':00'", column), nil
+		}
+		return fmt.Sprintf("substr(%s, 1, 10)", column), nil
+	case "postgres":
+		if hourly {
+			return fmt.Sprintf("TO_CHAR(%s, 'YYYY-MM-DD HH24:00')", column), nil
+		}
+		return fmt.Sprintf("TO_CHAR(%s, 'YYYY-MM-DD')", column), nil
+	default:
+		return "", fmt.Errorf("unsupported database dialect for dashboard stats: %s", dialect)
+	}
+}
+
 // DailyOrderStats returns per-day counts/amounts within [start, end],
 // zero-filling any days in the range that have no orders.
 // Only orders in StatusPaySuccess contribute to Amount sums — that's
 // what the user means by "流水". Pending orders count toward OrderCount
 // to keep成交率 computable.
 func DailyOrderStats(start, end time.Time) ([]DailyStat, error) {
-	var rows []DailyStat
+	rows, err := queryOrderStats(start, end, false)
-	err := dao.Mdb.Model(&mdb.Orders{}).
-		Select(`DATE(created_at) AS day,
-            COUNT(*) AS order_count,
-            SUM(CASE WHEN status = ? THEN 1 ELSE 0 END) AS success_count,
-            SUM(CASE WHEN status = ? THEN amount ELSE 0 END) AS total_amount,
-            SUM(CASE WHEN status = ? THEN actual_amount ELSE 0 END) AS actual_amount`,
-			mdb.StatusPaySuccess, mdb.StatusPaySuccess, mdb.StatusPaySuccess).
-		Where("created_at >= ?", start).
-		Where("created_at <= ?", end).
-		Group("DATE(created_at)").
-		Order("day ASC").
-		Scan(&rows).Error
 	if err != nil {
 		return nil, err
 	}
@@ -56,25 +72,34 @@ func DailyOrderStats(start, end time.Time) ([]DailyStat, error) {
 // HourlyOrderStats returns per-hour counts/amounts within [start, end],
 // zero-filling any hours that have no orders.
 func HourlyOrderStats(start, end time.Time) ([]DailyStat, error) {
-	var rows []DailyStat
+	rows, err := queryOrderStats(start, end, true)
-	err := dao.Mdb.Model(&mdb.Orders{}).
-		Select(`strftime('%Y-%m-%d %H:00', created_at) AS day,
-            COUNT(*) AS order_count,
-            SUM(CASE WHEN status = ? THEN 1 ELSE 0 END) AS success_count,
-            SUM(CASE WHEN status = ? THEN amount ELSE 0 END) AS total_amount,
-            SUM(CASE WHEN status = ? THEN actual_amount ELSE 0 END) AS actual_amount`,
-			mdb.StatusPaySuccess, mdb.StatusPaySuccess, mdb.StatusPaySuccess).
-		Where("created_at >= ?", start).
-		Where("created_at <= ?", end).
-		Group("strftime('%Y-%m-%d %H:00', created_at)").
-		Order("day ASC").
-		Scan(&rows).Error
 	if err != nil {
 		return nil, err
 	}
 	return fillHourlyStats(start, end, rows), nil
 }
 
+func queryOrderStats(start, end time.Time, hourly bool) ([]DailyStat, error) {
+	var rows []DailyStat
+	bucket, err := statsBucketExpr("created_at", hourly)
+	if err != nil {
+		return nil, err
+	}
+	err = dao.Mdb.Model(&mdb.Orders{}).
+		Select(fmt.Sprintf(`%s AS day,
+            COUNT(*) AS order_count,
+            SUM(CASE WHEN status = ? THEN 1 ELSE 0 END) AS success_count,
+            SUM(CASE WHEN status = ? THEN amount ELSE 0 END) AS total_amount,
+            SUM(CASE WHEN status = ? THEN actual_amount ELSE 0 END) AS actual_amount`, bucket),
+			mdb.StatusPaySuccess, mdb.StatusPaySuccess, mdb.StatusPaySuccess).
+		Where("created_at >= ?", start).
+		Where("created_at <= ?", end).
+		Group(bucket).
+		Order("day ASC").
+		Scan(&rows).Error
+	return rows, err
+}
+
 // fillDailyStats generates a zero-filled slice covering every calendar
 // day in [start, end]. Days present in rows overwrite the zero entries.
 func fillDailyStats(start, end time.Time, rows []DailyStat) []DailyStat {
@@ -122,15 +147,7 @@ func fillHourlyStats(start, end time.Time, rows []DailyStat) []DailyStat {
 // DailyAssetByAddress groups paid actual_amount by (day, receive_address)
 // for the per-address stacked chart, zero-filling missing days.
 func DailyAssetByAddress(start, end time.Time) ([]AddressDailyStat, error) {
-	var rows []AddressDailyStat
+	rows, err := queryAssetByAddress(start, end, false)
-	err := dao.Mdb.Model(&mdb.Orders{}).
-		Select("DATE(created_at) AS day, receive_address AS address, SUM(actual_amount) AS actual_amount").
-		Where("status = ?", mdb.StatusPaySuccess).
-		Where("created_at >= ?", start).
-		Where("created_at <= ?", end).
-		Group("DATE(created_at), receive_address").
-		Order("day ASC").
-		Scan(&rows).Error
 	if err != nil {
 		return nil, err
 	}
@@ -140,21 +157,33 @@ func DailyAssetByAddress(start, end time.Time) ([]AddressDailyStat, error) {
 // HourlyAssetByAddress groups paid actual_amount by (hour, receive_address)
 // for the per-address stacked chart, zero-filling missing hours.
 func HourlyAssetByAddress(start, end time.Time) ([]AddressDailyStat, error) {
-	var rows []AddressDailyStat
+	rows, err := queryAssetByAddress(start, end, true)
-	err := dao.Mdb.Model(&mdb.Orders{}).
-		Select("strftime('%Y-%m-%d %H:00', created_at) AS day, receive_address AS address, SUM(actual_amount) AS actual_amount").
-		Where("status = ?", mdb.StatusPaySuccess).
-		Where("created_at >= ?", start).
-		Where("created_at <= ?", end).
-		Group("strftime('%Y-%m-%d %H:00', created_at), receive_address").
-		Order("day ASC").
-		Scan(&rows).Error
 	if err != nil {
 		return nil, err
 	}
 	return fillAddressHourlyStats(start, end, rows), nil
 }
 
+func queryAssetByAddress(start, end time.Time, hourly bool) ([]AddressDailyStat, error) {
+	var rows []AddressDailyStat
+	bucket, err := statsBucketExpr("created_at", hourly)
+	if err != nil {
+		return nil, err
+	}
+	err = dao.Mdb.Model(&mdb.Orders{}).
+		Select(fmt.Sprintf(`%s AS day,
+            receive_address AS address,
+            SUM(actual_amount) AS actual_amount`, bucket)).
+		Where("status = ?", mdb.StatusPaySuccess).
+		Where("created_at >= ?", start).
+		Where("created_at <= ?", end).
+		Group(bucket).
+		Group("receive_address").
+		Order("day ASC, address ASC").
+		Scan(&rows).Error
+	return rows, err
+}
+
 // fillAddressDailyStats zero-fills missing day×address combinations.
 // All addresses that appear in rows are represented for every day in range.
 func fillAddressDailyStats(start, end time.Time, rows []AddressDailyStat) []AddressDailyStat {

src/model/data/order_data_test.go

@@ -8,6 +8,7 @@ import (
 
 	"github.com/GMWalletApp/epusdt/internal/testutil"
 	"github.com/GMWalletApp/epusdt/model/mdb"
+	"github.com/xssnick/tonutils-go/address"
 )
 
 func TestEvmTransactionLockAddressIsCaseInsensitive(t *testing.T) {
@@ -42,6 +43,56 @@ func TestEvmTransactionLockAddressIsCaseInsensitive(t *testing.T) {
 	}
 }
 
+func TestStatsBucketExprForDialect(t *testing.T) {
+	tests := []struct {
+		name    string
+		dialect string
+		hourly  bool
+		want    string
+	}{
+		{
+			name:    "sqlite daily",
+			dialect: "sqlite",
+			want:    "substr(created_at, 1, 10)",
+		},
+		{
+			name:    "sqlite hourly",
+			dialect: "sqlite",
+			hourly:  true,
+			want:    "replace(substr(created_at, 1, 13), 'T', ' ') || ':00'",
+		},
+		{
+			name:    "postgres daily",
+			dialect: "postgres",
+			want:    "TO_CHAR(created_at, 'YYYY-MM-DD')",
+		},
+		{
+			name:    "postgres hourly",
+			dialect: "postgres",
+			hourly:  true,
+			want:    "TO_CHAR(created_at, 'YYYY-MM-DD HH24:00')",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := statsBucketExprForDialect(tt.dialect, "created_at", tt.hourly)
+			if err != nil {
+				t.Fatalf("statsBucketExprForDialect error: %v", err)
+			}
+			if got != tt.want {
+				t.Fatalf("bucket expr = %q, want %q", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestStatsBucketExprRejectsUnsupportedDialect(t *testing.T) {
+	if _, err := statsBucketExprForDialect("mysql", "created_at", false); err == nil {
+		t.Fatal("expected unsupported mysql dialect error")
+	}
+}
+
 func TestTransactionLockPrecisionPreventsEquivalentAmountsOnly(t *testing.T) {
 	cleanup := testutil.SetupTestDatabases(t)
 	defer cleanup()
@@ -106,3 +157,30 @@ func TestNonEvmTransactionLockAddressRemainsCaseSensitive(t *testing.T) {
 		t.Fatalf("tron address lookup should remain case-sensitive, got trade id %q", gotTradeID)
 	}
 }
+
+func TestTonTransactionLockAddressUsesRawKey(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+
+	bounceable := "EQC6KV4zs8TJtSZapOrRFmqSkxzpq-oSCoxekQRKElf4nC1I"
+	addr := address.MustParseAddr(bounceable)
+	nonBounce := addr.Bounce(false).String()
+
+	if err := LockTransaction(mdb.NetworkTon, bounceable, "TON", "trade-ton", 1.23, time.Hour); err != nil {
+		t.Fatalf("lock ton transaction: %v", err)
+	}
+	gotTradeID, err := GetTradeIdByWalletAddressAndAmountAndToken(mdb.NetworkTon, nonBounce, "TON", 1.23)
+	if err != nil {
+		t.Fatalf("lookup ton lock: %v", err)
+	}
+	if gotTradeID != "trade-ton" {
+		t.Fatalf("ton lock lookup = %q, want trade-ton", gotTradeID)
+	}
+	gotTradeID, err = GetTradeIdByWalletAddressAndAmountAndToken(mdb.NetworkTon, addr.StringRaw(), "TON", 1.23)
+	if err != nil {
+		t.Fatalf("lookup ton raw lock: %v", err)
+	}
+	if gotTradeID != "trade-ton" {
+		t.Fatalf("ton raw lock lookup = %q, want trade-ton", gotTradeID)
+	}
+}

src/model/data/provider_order_data.go

@@ -4,6 +4,7 @@ import (
 	"github.com/GMWalletApp/epusdt/model/dao"
 	"github.com/GMWalletApp/epusdt/model/mdb"
 	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
 )
 
 func GetProviderOrderByTradeIDAndProvider(tradeID string, provider string) (*mdb.ProviderOrder, error) {
@@ -20,8 +21,27 @@ func CreateProviderOrderWithTransaction(tx *gorm.DB, row *mdb.ProviderOrder) err
 	return tx.Model(row).Create(row).Error
 }
 
+func UpsertProviderOrderCreatingWithTransaction(tx *gorm.DB, row *mdb.ProviderOrder) error {
+	return tx.Clauses(clause.OnConflict{
+		Columns: []clause.Column{{Name: "trade_id"}, {Name: "provider"}},
+		DoUpdates: clause.AssignmentColumns([]string{
+			"provider_order_id",
+			"pay_url",
+			"amount",
+			"coin",
+			"status",
+			"notify_raw",
+			"updated_at",
+		}),
+	}).Create(row).Error
+}
+
 func UpdateProviderOrderCreated(tradeID string, provider string, providerOrderID string, payURL string) error {
-	return dao.Mdb.Model(&mdb.ProviderOrder{}).
+	return UpdateProviderOrderCreatedWithTransaction(dao.Mdb, tradeID, provider, providerOrderID, payURL)
+}
+
+func UpdateProviderOrderCreatedWithTransaction(tx *gorm.DB, tradeID string, provider string, providerOrderID string, payURL string) error {
+	return tx.Model(&mdb.ProviderOrder{}).
 		Where("trade_id = ?", tradeID).
 		Where("provider = ?", provider).
 		Updates(map[string]interface{}{

src/model/data/rpc_node_data.go

@@ -1,14 +1,44 @@
 package data
 
 import (
+	"fmt"
 	"math/rand"
+	"net/url"
+	"sort"
 	"strings"
+	"sync"
+	"time"
 
 	"github.com/GMWalletApp/epusdt/model/dao"
 	"github.com/GMWalletApp/epusdt/model/mdb"
 	"github.com/dromara/carbon/v2"
 )
 
+const (
+	RpcFailoverThreshold = 3
+	RpcFailoverCooldown  = 60 * time.Second
+)
+
+var gRpcFailover = struct {
+	sync.Mutex
+	failures      map[uint64]int
+	cooldownUntil map[uint64]time.Time
+}{
+	failures:      make(map[uint64]int),
+	cooldownUntil: make(map[uint64]time.Time),
+}
+
+func NormalizeRpcNodePurpose(purpose string) string {
+	switch strings.ToLower(strings.TrimSpace(purpose)) {
+	case mdb.RpcNodePurposeManualVerify:
+		return mdb.RpcNodePurposeManualVerify
+	case mdb.RpcNodePurposeBoth:
+		return mdb.RpcNodePurposeBoth
+	default:
+		return mdb.RpcNodePurposeGeneral
+	}
+}
+
 // ListRpcNodes returns rows optionally filtered by network.
 func ListRpcNodes(network string) ([]mdb.RpcNode, error) {
 	var rows []mdb.RpcNode
@@ -20,6 +50,84 @@ func ListRpcNodes(network string) ([]mdb.RpcNode, error) {
 	return rows, err
 }
 
+// ListRpcNodesForHealth returns nodes that should be probed by the periodic
+// health job. Manual verification nodes are intentionally excluded because
+// they may be paid/high-limit endpoints that should only be used on demand.
+func ListRpcNodesForHealth() ([]mdb.RpcNode, error) {
+	var rows []mdb.RpcNode
+	err := dao.Mdb.Model(&mdb.RpcNode{}).
+		Where("(purpose IN ? OR purpose = '' OR purpose IS NULL)", []string{mdb.RpcNodePurposeGeneral, mdb.RpcNodePurposeBoth}).
+		Order("id ASC").
+		Find(&rows).Error
+	return rows, err
+}
+
+// ListGeneralRpcCandidates returns enabled non-manual nodes for ordinary
+// scanners/listeners. Down nodes are skipped; ok nodes are ordered before
+// unknown/bootstrap nodes.
+func ListGeneralRpcCandidates(network, nodeType string) ([]mdb.RpcNode, error) {
+	var rows []mdb.RpcNode
+	err := dao.Mdb.Model(&mdb.RpcNode{}).
+		Where("network = ?", strings.ToLower(strings.TrimSpace(network))).
+		Where("type = ?", strings.ToLower(strings.TrimSpace(nodeType))).
+		Where("enabled = ?", true).
+		Where("(purpose IN ? OR purpose = '' OR purpose IS NULL)", []string{mdb.RpcNodePurposeGeneral, mdb.RpcNodePurposeBoth}).
+		Where("(status IN ? OR status = '' OR status IS NULL)", []string{mdb.RpcNodeStatusOk, mdb.RpcNodeStatusUnknown}).
+		Find(&rows).Error
+	if err != nil {
+		return nil, err
+	}
+
+	buckets := make([][]mdb.RpcNode, 2)
+	for _, row := range rows {
+		row.Purpose = NormalizeRpcNodePurpose(row.Purpose)
+		if row.Status == mdb.RpcNodeStatusOk {
+			buckets[0] = append(buckets[0], row)
+		} else {
+			buckets[1] = append(buckets[1], row)
+		}
+	}
+
+	out := make([]mdb.RpcNode, 0, len(rows))
+	for _, bucket := range buckets {
+		sortRpcNodes(bucket)
+		out = append(out, bucket...)
+	}
+	return out, nil
+}
+
+func SelectGeneralRpcNode(network, nodeType string, excludeIDs ...uint64) (*mdb.RpcNode, error) {
+	rows, err := ListGeneralRpcCandidates(network, nodeType)
+	if err != nil {
+		return nil, err
+	}
+	if len(rows) == 0 {
+		return nil, nil
+	}
+
+	excluded := make(map[uint64]struct{}, len(excludeIDs))
+	for _, id := range excludeIDs {
+		if id > 0 {
+			excluded[id] = struct{}{}
+		}
+	}
+	for i := range rows {
+		if _, ok := excluded[rows[i].ID]; ok {
+			continue
+		}
+		if IsRpcNodeCoolingDown(rows[i].ID) {
+			continue
+		}
+		return &rows[i], nil
+	}
+	if len(excluded) == 0 {
+		for i := range rows {
+			return &rows[i], nil
+		}
+	}
+	return nil, nil
+}
+
 // GetRpcNodeByID fetches one row.
 func GetRpcNodeByID(id uint64) (*mdb.RpcNode, error) {
 	row := new(mdb.RpcNode)
@@ -29,6 +137,7 @@ func GetRpcNodeByID(id uint64) (*mdb.RpcNode, error) {
 
 // CreateRpcNode inserts a row.
 func CreateRpcNode(row *mdb.RpcNode) error {
+	row.Purpose = NormalizeRpcNodePurpose(row.Purpose)
 	return dao.Mdb.Create(row).Error
 }
 
@@ -37,6 +146,9 @@ func UpdateRpcNodeFields(id uint64, fields map[string]interface{}) error {
 	if len(fields) == 0 {
 		return nil
 	}
+	if purpose, ok := fields["purpose"].(string); ok {
+		fields["purpose"] = NormalizeRpcNodePurpose(purpose)
+	}
 	return dao.Mdb.Model(&mdb.RpcNode{}).Where("id = ?", id).Updates(fields).Error
 }
 
@@ -48,13 +160,15 @@ func DeleteRpcNodeByID(id uint64) error {
 // SelectRpcNode picks a healthy RPC endpoint for a (network, type) pair.
 // Strategy: weighted random among rows where enabled=true AND status=ok.
 // Falls back to enabled rows with status=unknown when no health check has
-// run yet. Explicitly down rows are not selected.
+// run yet. Explicitly down rows are not selected. Manual verification nodes
+// are excluded so paid/manual-only RPCs are never used by scanners/listeners.
 func SelectRpcNode(network, nodeType string) (*mdb.RpcNode, error) {
 	var rows []mdb.RpcNode
 	err := dao.Mdb.Model(&mdb.RpcNode{}).
 		Where("network = ?", strings.ToLower(network)).
 		Where("type = ?", strings.ToLower(nodeType)).
 		Where("enabled = ?", true).
+		Where("(purpose IN ? OR purpose = '' OR purpose IS NULL)", []string{mdb.RpcNodePurposeGeneral, mdb.RpcNodePurposeBoth}).
 		Find(&rows).Error
 	if err != nil {
 		return nil, err
@@ -82,6 +196,144 @@ func SelectRpcNode(network, nodeType string) (*mdb.RpcNode, error) {
 	return pickWeighted(candidates), nil
 }
 
+// ListManualPaymentRpcCandidates returns enabled RPC nodes for manual payment
+// verification. Ordinary RPCs are tried first to avoid paid endpoint usage;
+// manual_verify nodes are used only as a fallback.
+func ListManualPaymentRpcCandidates(network, nodeType string) ([]mdb.RpcNode, error) {
+	var rows []mdb.RpcNode
+	err := dao.Mdb.Model(&mdb.RpcNode{}).
+		Where("network = ?", strings.ToLower(strings.TrimSpace(network))).
+		Where("type = ?", strings.ToLower(strings.TrimSpace(nodeType))).
+		Where("enabled = ?", true).
+		Where("(status IN ? OR status = '' OR status IS NULL)", []string{mdb.RpcNodeStatusOk, mdb.RpcNodeStatusUnknown}).
+		Find(&rows).Error
+	if err != nil {
+		return nil, err
+	}
+	if len(rows) == 0 {
+		return nil, nil
+	}
+
+	buckets := make([][]mdb.RpcNode, 4)
+	for _, row := range rows {
+		row.Purpose = NormalizeRpcNodePurpose(row.Purpose)
+		switch row.Purpose {
+		case mdb.RpcNodePurposeGeneral, mdb.RpcNodePurposeBoth:
+			if row.Status == mdb.RpcNodeStatusOk {
+				buckets[0] = append(buckets[0], row)
+			} else {
+				buckets[1] = append(buckets[1], row)
+			}
+		case mdb.RpcNodePurposeManualVerify:
+			if row.Status == mdb.RpcNodeStatusOk {
+				buckets[2] = append(buckets[2], row)
+			} else {
+				buckets[3] = append(buckets[3], row)
+			}
+		}
+	}
+
+	out := make([]mdb.RpcNode, 0, len(rows))
+	for _, bucket := range buckets {
+		sortRpcNodes(bucket)
+		out = append(out, bucket...)
+	}
+	return out, nil
+}
+
+func sortRpcNodes(rows []mdb.RpcNode) {
+	sort.SliceStable(rows, func(i, j int) bool {
+		if rows[i].Weight != rows[j].Weight {
+			return rows[i].Weight > rows[j].Weight
+		}
+		return rows[i].ID < rows[j].ID
+	})
+}
+
+func RecordRpcNodeSuccess(nodeID uint64) {
+	if nodeID == 0 {
+		return
+	}
+	gRpcFailover.Lock()
+	defer gRpcFailover.Unlock()
+	delete(gRpcFailover.failures, nodeID)
+	delete(gRpcFailover.cooldownUntil, nodeID)
+}
+
+func RecordRpcNodeFailure(nodeID uint64) (int, bool) {
+	if nodeID == 0 {
+		return 0, false
+	}
+	now := time.Now()
+	gRpcFailover.Lock()
+	defer gRpcFailover.Unlock()
+	if until, ok := gRpcFailover.cooldownUntil[nodeID]; ok {
+		if now.Before(until) {
+			return gRpcFailover.failures[nodeID], true
+		}
+		delete(gRpcFailover.cooldownUntil, nodeID)
+		delete(gRpcFailover.failures, nodeID)
+	}
+
+	gRpcFailover.failures[nodeID]++
+	failures := gRpcFailover.failures[nodeID]
+	if failures >= RpcFailoverThreshold {
+		gRpcFailover.failures[nodeID] = 0
+		gRpcFailover.cooldownUntil[nodeID] = now.Add(RpcFailoverCooldown)
+		return failures, true
+	}
+	return failures, false
+}
+
+func IsRpcNodeCoolingDown(nodeID uint64) bool {
+	if nodeID == 0 {
+		return false
+	}
+	now := time.Now()
+	gRpcFailover.Lock()
+	defer gRpcFailover.Unlock()
+	until, ok := gRpcFailover.cooldownUntil[nodeID]
+	if !ok {
+		return false
+	}
+	if now.Before(until) {
+		return true
+	}
+	delete(gRpcFailover.cooldownUntil, nodeID)
+	delete(gRpcFailover.failures, nodeID)
+	return false
+}
+
+func RpcNodeLogLabel(node mdb.RpcNode) string {
+	return fmt.Sprintf("id=%d network=%s type=%s endpoint=%s", node.ID, node.Network, node.Type, safeRpcEndpoint(node.Url))
+}
+
+func safeRpcEndpoint(raw string) string {
+	raw = strings.TrimSpace(raw)
+	if raw == "" {
+		return ""
+	}
+	parsed, err := url.Parse(raw)
+	if err == nil && parsed.Host != "" {
+		if parsed.Scheme != "" {
+			return parsed.Scheme + "://" + parsed.Host
+		}
+		return parsed.Host
+	}
+	cut := strings.IndexAny(raw, "/?")
+	if cut >= 0 {
+		return raw[:cut]
+	}
+	return raw
+}
+
+func ResetRpcFailoverForTest() {
+	gRpcFailover.Lock()
+	defer gRpcFailover.Unlock()
+	gRpcFailover.failures = make(map[uint64]int)
+	gRpcFailover.cooldownUntil = make(map[uint64]time.Time)
+}
+
 // pickWeighted chooses one row using the Weight column. Weights < 1 are
 // coerced to 1 so an admin-zeroed row still has a chance (use Enabled=false
 // to truly disable).

src/model/data/rpc_node_data_test.go

@@ -1,6 +1,7 @@
 package data
 
 import (
+	"strings"
 	"testing"
 
 	"github.com/GMWalletApp/epusdt/internal/testutil"
@@ -99,3 +100,306 @@ func TestSelectRpcNodeIgnoresDownRows(t *testing.T) {
 		t.Fatalf("SelectRpcNode() = %#v, want nil", got)
 	}
 }
+
+func TestSelectRpcNodeExcludesManualVerifyRows(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+
+	if err := dao.Mdb.Create(&mdb.RpcNode{
+		Network: mdb.NetworkTron,
+		Url:     "https://manual.example.com",
+		Type:    mdb.RpcNodeTypeHttp,
+		Weight:  100,
+		Enabled: true,
+		Purpose: mdb.RpcNodePurposeManualVerify,
+		Status:  mdb.RpcNodeStatusOk,
+	}).Error; err != nil {
+		t.Fatalf("seed manual rpc_node: %v", err)
+	}
+	if err := dao.Mdb.Create(&mdb.RpcNode{
+		Network: mdb.NetworkTron,
+		Url:     "https://general.example.com",
+		Type:    mdb.RpcNodeTypeHttp,
+		Weight:  1,
+		Enabled: true,
+		Purpose: mdb.RpcNodePurposeGeneral,
+		Status:  mdb.RpcNodeStatusUnknown,
+	}).Error; err != nil {
+		t.Fatalf("seed general rpc_node: %v", err)
+	}
+
+	got, err := SelectRpcNode(mdb.NetworkTron, mdb.RpcNodeTypeHttp)
+	if err != nil {
+		t.Fatalf("SelectRpcNode(): %v", err)
+	}
+	if got == nil || got.Url != "https://general.example.com" {
+		t.Fatalf("SelectRpcNode() = %#v, want general row", got)
+	}
+}
+
+func TestSelectRpcNodePurposeFilterAppliesToAnyNodeType(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+
+	const nodeType = "grpc"
+	if err := dao.Mdb.Create(&mdb.RpcNode{
+		Network: mdb.NetworkTron,
+		Url:     "grpc://manual.example.com",
+		Type:    nodeType,
+		Weight:  100,
+		Enabled: true,
+		Purpose: mdb.RpcNodePurposeManualVerify,
+		Status:  mdb.RpcNodeStatusOk,
+	}).Error; err != nil {
+		t.Fatalf("seed manual rpc_node: %v", err)
+	}
+	if err := dao.Mdb.Create(&mdb.RpcNode{
+		Network: mdb.NetworkTron,
+		Url:     "grpc://general.example.com",
+		Type:    nodeType,
+		Weight:  1,
+		Enabled: true,
+		Purpose: mdb.RpcNodePurposeGeneral,
+		Status:  mdb.RpcNodeStatusOk,
+	}).Error; err != nil {
+		t.Fatalf("seed general rpc_node: %v", err)
+	}
+
+	got, err := SelectRpcNode(mdb.NetworkTron, nodeType)
+	if err != nil {
+		t.Fatalf("SelectRpcNode(): %v", err)
+	}
+	if got == nil || got.Url != "grpc://general.example.com" {
+		t.Fatalf("SelectRpcNode() = %#v, want general grpc row", got)
+	}
+}
+
+func TestSelectRpcNodeManualVerifyOnlyReturnsNil(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+
+	if err := dao.Mdb.Create(&mdb.RpcNode{
+		Network: mdb.NetworkTron,
+		Url:     "https://manual-only.example.com",
+		Type:    mdb.RpcNodeTypeHttp,
+		Weight:  1,
+		Enabled: true,
+		Purpose: mdb.RpcNodePurposeManualVerify,
+		Status:  mdb.RpcNodeStatusOk,
+	}).Error; err != nil {
+		t.Fatalf("seed manual rpc_node: %v", err)
+	}
+
+	got, err := SelectRpcNode(mdb.NetworkTron, mdb.RpcNodeTypeHttp)
+	if err != nil {
+		t.Fatalf("SelectRpcNode(): %v", err)
+	}
+	if got != nil {
+		t.Fatalf("SelectRpcNode() = %#v, want nil", got)
+	}
+}
+
+func TestListManualPaymentRpcCandidatesGeneralBeforeManualVerify(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+
+	rows := []mdb.RpcNode{
+		{Network: mdb.NetworkTron, Url: "https://manual-ok.example.com", Type: mdb.RpcNodeTypeHttp, Weight: 1, Enabled: true, Purpose: mdb.RpcNodePurposeManualVerify, Status: mdb.RpcNodeStatusOk},
+		{Network: mdb.NetworkTron, Url: "https://general-unknown.example.com", Type: mdb.RpcNodeTypeHttp, Weight: 1, Enabled: true, Purpose: mdb.RpcNodePurposeGeneral, Status: mdb.RpcNodeStatusUnknown},
+		{Network: mdb.NetworkTron, Url: "https://general-ok.example.com", Type: mdb.RpcNodeTypeHttp, Weight: 1, Enabled: true, Purpose: mdb.RpcNodePurposeGeneral, Status: mdb.RpcNodeStatusOk},
+		{Network: mdb.NetworkTron, Url: "https://manual-unknown.example.com", Type: mdb.RpcNodeTypeHttp, Weight: 1, Enabled: true, Purpose: mdb.RpcNodePurposeManualVerify, Status: mdb.RpcNodeStatusUnknown},
+		{Network: mdb.NetworkTron, Url: "https://down.example.com", Type: mdb.RpcNodeTypeHttp, Weight: 1, Enabled: true, Purpose: mdb.RpcNodePurposeGeneral, Status: mdb.RpcNodeStatusDown},
+	}
+	if err := dao.Mdb.Create(&rows).Error; err != nil {
+		t.Fatalf("seed rpc_nodes: %v", err)
+	}
+
+	got, err := ListManualPaymentRpcCandidates(mdb.NetworkTron, mdb.RpcNodeTypeHttp)
+	if err != nil {
+		t.Fatalf("ListManualPaymentRpcCandidates(): %v", err)
+	}
+	var urls []string
+	for _, row := range got {
+		urls = append(urls, row.Url)
+	}
+	want := []string{
+		"https://general-ok.example.com",
+		"https://general-unknown.example.com",
+		"https://manual-ok.example.com",
+		"https://manual-unknown.example.com",
+	}
+	if len(urls) != len(want) {
+		t.Fatalf("candidate urls = %#v, want %#v", urls, want)
+	}
+	for i := range want {
+		if urls[i] != want[i] {
+			t.Fatalf("candidate urls = %#v, want %#v", urls, want)
+		}
+	}
+}
+
+func TestListManualPaymentRpcCandidatesAllowsManualVerifyFallbackOnly(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+
+	rows := []mdb.RpcNode{
+		{Network: mdb.NetworkTron, Url: "https://manual-ok.example.com", Type: mdb.RpcNodeTypeHttp, Weight: 1, Enabled: true, Purpose: mdb.RpcNodePurposeManualVerify, Status: mdb.RpcNodeStatusOk},
+		{Network: mdb.NetworkTron, Url: "https://manual-down.example.com", Type: mdb.RpcNodeTypeHttp, Weight: 1, Enabled: true, Purpose: mdb.RpcNodePurposeManualVerify, Status: mdb.RpcNodeStatusDown},
+	}
+	if err := dao.Mdb.Create(&rows).Error; err != nil {
+		t.Fatalf("seed rpc_nodes: %v", err)
+	}
+
+	got, err := ListManualPaymentRpcCandidates(mdb.NetworkTron, mdb.RpcNodeTypeHttp)
+	if err != nil {
+		t.Fatalf("ListManualPaymentRpcCandidates(): %v", err)
+	}
+	if len(got) != 1 || got[0].Url != "https://manual-ok.example.com" {
+		t.Fatalf("candidate rows = %#v, want only manual ok fallback", got)
+	}
+}
+
+func TestSelectGeneralRpcNodeSkipsCoolingNode(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+	ResetRpcFailoverForTest()
+	t.Cleanup(ResetRpcFailoverForTest)
+
+	rows := []mdb.RpcNode{
+		{Network: mdb.NetworkTron, Url: "https://primary.example.com", Type: mdb.RpcNodeTypeHttp, Weight: 100, Enabled: true, Purpose: mdb.RpcNodePurposeGeneral, Status: mdb.RpcNodeStatusOk},
+		{Network: mdb.NetworkTron, Url: "https://backup.example.com", Type: mdb.RpcNodeTypeHttp, Weight: 1, Enabled: true, Purpose: mdb.RpcNodePurposeGeneral, Status: mdb.RpcNodeStatusOk},
+	}
+	if err := dao.Mdb.Create(&rows).Error; err != nil {
+		t.Fatalf("seed rpc_nodes: %v", err)
+	}
+
+	first, err := SelectGeneralRpcNode(mdb.NetworkTron, mdb.RpcNodeTypeHttp)
+	if err != nil {
+		t.Fatalf("SelectGeneralRpcNode(): %v", err)
+	}
+	if first == nil || first.Url != "https://primary.example.com" {
+		t.Fatalf("first node = %#v, want primary", first)
+	}
+
+	for i := 0; i < RpcFailoverThreshold; i++ {
+		RecordRpcNodeFailure(first.ID)
+	}
+
+	got, err := SelectGeneralRpcNode(mdb.NetworkTron, mdb.RpcNodeTypeHttp)
+	if err != nil {
+		t.Fatalf("SelectGeneralRpcNode(): %v", err)
+	}
+	if got == nil || got.Url != "https://backup.example.com" {
+		t.Fatalf("node after cooldown = %#v, want backup", got)
+	}
+}
+
+func TestSelectGeneralRpcNodeFallsBackWhenAllNodesCooling(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+	ResetRpcFailoverForTest()
+	t.Cleanup(ResetRpcFailoverForTest)
+
+	rows := []mdb.RpcNode{
+		{Network: mdb.NetworkTron, Url: "https://primary.example.com", Type: mdb.RpcNodeTypeHttp, Weight: 100, Enabled: true, Purpose: mdb.RpcNodePurposeGeneral, Status: mdb.RpcNodeStatusOk},
+		{Network: mdb.NetworkTron, Url: "https://backup.example.com", Type: mdb.RpcNodeTypeHttp, Weight: 1, Enabled: true, Purpose: mdb.RpcNodePurposeGeneral, Status: mdb.RpcNodeStatusOk},
+	}
+	if err := dao.Mdb.Create(&rows).Error; err != nil {
+		t.Fatalf("seed rpc_nodes: %v", err)
+	}
+	for i := range rows {
+		for n := 0; n < RpcFailoverThreshold; n++ {
+			RecordRpcNodeFailure(rows[i].ID)
+		}
+	}
+
+	got, err := SelectGeneralRpcNode(mdb.NetworkTron, mdb.RpcNodeTypeHttp)
+	if err != nil {
+		t.Fatalf("SelectGeneralRpcNode(): %v", err)
+	}
+	if got == nil || got.Url != "https://primary.example.com" {
+		t.Fatalf("SelectGeneralRpcNode() = %#v, want primary when every node is cooling", got)
+	}
+}
+
+func TestSelectGeneralRpcNodeReturnsNilWhenExcludedAlternatesCooling(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+	ResetRpcFailoverForTest()
+	t.Cleanup(ResetRpcFailoverForTest)
+
+	rows := []mdb.RpcNode{
+		{Network: mdb.NetworkTron, Url: "https://primary.example.com", Type: mdb.RpcNodeTypeHttp, Weight: 100, Enabled: true, Purpose: mdb.RpcNodePurposeGeneral, Status: mdb.RpcNodeStatusOk},
+		{Network: mdb.NetworkTron, Url: "https://backup.example.com", Type: mdb.RpcNodeTypeHttp, Weight: 1, Enabled: true, Purpose: mdb.RpcNodePurposeGeneral, Status: mdb.RpcNodeStatusOk},
+	}
+	if err := dao.Mdb.Create(&rows).Error; err != nil {
+		t.Fatalf("seed rpc_nodes: %v", err)
+	}
+	for i := 0; i < RpcFailoverThreshold; i++ {
+		RecordRpcNodeFailure(rows[1].ID)
+	}
+
+	got, err := SelectGeneralRpcNode(mdb.NetworkTron, mdb.RpcNodeTypeHttp, rows[0].ID)
+	if err != nil {
+		t.Fatalf("SelectGeneralRpcNode(): %v", err)
+	}
+	if got != nil {
+		t.Fatalf("SelectGeneralRpcNode() = %#v, want nil when only alternate is cooling", got)
+	}
+}
+
+func TestRecordRpcNodeSuccessClearsCooldown(t *testing.T) {
+	ResetRpcFailoverForTest()
+	t.Cleanup(ResetRpcFailoverForTest)
+
+	const nodeID uint64 = 42
+	for i := 0; i < RpcFailoverThreshold; i++ {
+		RecordRpcNodeFailure(nodeID)
+	}
+	if !IsRpcNodeCoolingDown(nodeID) {
+		t.Fatal("node should be cooling after threshold")
+	}
+	RecordRpcNodeSuccess(nodeID)
+	if IsRpcNodeCoolingDown(nodeID) {
+		t.Fatal("node should not be cooling after success")
+	}
+	failures, cooling := RecordRpcNodeFailure(nodeID)
+	if cooling || failures != 1 {
+		t.Fatalf("failure state after success = failures=%d cooling=%v, want failures=1 cooling=false", failures, cooling)
+	}
+}
+
+func TestRpcNodeLogLabelHidesPathAndQuery(t *testing.T) {
+	label := RpcNodeLogLabel(mdb.RpcNode{
+		BaseModel: mdb.BaseModel{ID: 7},
+		Network:   mdb.NetworkEthereum,
+		Type:      mdb.RpcNodeTypeWs,
+		Url:       "wss://rpc.example.com/v3/secret-key?token=secret",
+	})
+	if strings.Contains(label, "secret") || strings.Contains(label, "/v3/") {
+		t.Fatalf("RpcNodeLogLabel() leaked sensitive URL parts: %s", label)
+	}
+	if !strings.Contains(label, "wss://rpc.example.com") {
+		t.Fatalf("RpcNodeLogLabel() = %s, want host", label)
+	}
+}
+
+func TestListRpcNodesForHealthExcludesManualVerify(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+
+	rows := []mdb.RpcNode{
+		{Network: mdb.NetworkTron, Url: "https://general.example.com", Type: mdb.RpcNodeTypeHttp, Enabled: true, Purpose: mdb.RpcNodePurposeGeneral, Status: mdb.RpcNodeStatusUnknown},
+		{Network: mdb.NetworkTron, Url: "https://manual.example.com", Type: mdb.RpcNodeTypeHttp, Enabled: true, Purpose: mdb.RpcNodePurposeManualVerify, Status: mdb.RpcNodeStatusUnknown},
+	}
+	if err := dao.Mdb.Create(&rows).Error; err != nil {
+		t.Fatalf("seed rpc_nodes: %v", err)
+	}
+	got, err := ListRpcNodesForHealth()
+	if err != nil {
+		t.Fatalf("ListRpcNodesForHealth(): %v", err)
+	}
+	if len(got) != 1 || got[0].Url != "https://general.example.com" {
+		t.Fatalf("ListRpcNodesForHealth() = %#v, want only general row", got)
+	}
+}

src/model/data/rpc_runtime_stats.go

@@ -0,0 +1,108 @@
+package data
+
+import (
+	"strings"
+	"sync"
+	"time"
+)
+
+// RpcRuntimeStatsSnapshot is an in-process snapshot of RPC activity for one
+// chain. It is intentionally not persisted; restarting the process resets it.
+type RpcRuntimeStatsSnapshot struct {
+	Network           string
+	SuccessCount      int64
+	FailureCount      int64
+	LatestBlockHeight int64
+	LastSyncAt        time.Time
+}
+
+type rpcRuntimeStatsCounter struct {
+	successCount      int64
+	failureCount      int64
+	latestBlockHeight int64
+	lastSyncAt        time.Time
+}
+
+var gRpcRuntimeStats = struct {
+	sync.RWMutex
+	byNetwork map[string]*rpcRuntimeStatsCounter
+}{
+	byNetwork: make(map[string]*rpcRuntimeStatsCounter),
+}
+
+func normalizeRpcStatsNetwork(network string) string {
+	return strings.ToLower(strings.TrimSpace(network))
+}
+
+func rpcStatsCounterLocked(network string) *rpcRuntimeStatsCounter {
+	counter := gRpcRuntimeStats.byNetwork[network]
+	if counter == nil {
+		counter = &rpcRuntimeStatsCounter{}
+		gRpcRuntimeStats.byNetwork[network] = counter
+	}
+	return counter
+}
+
+// RecordRpcSuccess records one successful application-level RPC operation.
+func RecordRpcSuccess(network string) {
+	network = normalizeRpcStatsNetwork(network)
+	if network == "" {
+		return
+	}
+	gRpcRuntimeStats.Lock()
+	defer gRpcRuntimeStats.Unlock()
+	counter := rpcStatsCounterLocked(network)
+	counter.successCount++
+	counter.lastSyncAt = time.Now()
+}
+
+// RecordRpcFailure records one failed application-level RPC operation.
+func RecordRpcFailure(network string) {
+	network = normalizeRpcStatsNetwork(network)
+	if network == "" {
+		return
+	}
+	gRpcRuntimeStats.Lock()
+	defer gRpcRuntimeStats.Unlock()
+	counter := rpcStatsCounterLocked(network)
+	counter.failureCount++
+}
+
+// RecordRpcBlockHeight records the latest observed chain height.
+func RecordRpcBlockHeight(network string, height int64) {
+	network = normalizeRpcStatsNetwork(network)
+	if network == "" || height <= 0 {
+		return
+	}
+	gRpcRuntimeStats.Lock()
+	defer gRpcRuntimeStats.Unlock()
+	counter := rpcStatsCounterLocked(network)
+	counter.lastSyncAt = time.Now()
+	if height > counter.latestBlockHeight {
+		counter.latestBlockHeight = height
+	}
+}
+
+// SnapshotRpcRuntimeStats returns a copy of the current per-chain counters.
+func SnapshotRpcRuntimeStats() map[string]RpcRuntimeStatsSnapshot {
+	gRpcRuntimeStats.RLock()
+	defer gRpcRuntimeStats.RUnlock()
+	out := make(map[string]RpcRuntimeStatsSnapshot, len(gRpcRuntimeStats.byNetwork))
+	for network, counter := range gRpcRuntimeStats.byNetwork {
+		out[network] = RpcRuntimeStatsSnapshot{
+			Network:           network,
+			SuccessCount:      counter.successCount,
+			FailureCount:      counter.failureCount,
+			LatestBlockHeight: counter.latestBlockHeight,
+			LastSyncAt:        counter.lastSyncAt,
+		}
+	}
+	return out
+}
+
+// ResetRpcRuntimeStatsForTest clears process-local stats for isolated tests.
+func ResetRpcRuntimeStatsForTest() {
+	gRpcRuntimeStats.Lock()
+	defer gRpcRuntimeStats.Unlock()
+	gRpcRuntimeStats.byNetwork = make(map[string]*rpcRuntimeStatsCounter)
+}

src/model/data/rpc_runtime_stats_test.go

@@ -0,0 +1,81 @@
+package data
+
+import (
+	"testing"
+	"time"
+)
+
+func TestRpcRuntimeStatsRecordsCountsAndLatestHeight(t *testing.T) {
+	ResetRpcRuntimeStatsForTest()
+	t.Cleanup(ResetRpcRuntimeStatsForTest)
+
+	start := time.Now()
+	RecordRpcSuccess(" TRON ")
+	RecordRpcSuccess("tron")
+	RecordRpcFailure("TRON")
+	RecordRpcBlockHeight("Tron", 100)
+	RecordRpcBlockHeight("tron", 90)
+
+	stats := SnapshotRpcRuntimeStats()
+	got, ok := stats["tron"]
+	if !ok {
+		t.Fatalf("missing tron stats: %#v", stats)
+	}
+	if got.Network != "tron" {
+		t.Fatalf("network = %q, want tron", got.Network)
+	}
+	if got.SuccessCount != 2 {
+		t.Fatalf("success count = %d, want 2", got.SuccessCount)
+	}
+	if got.FailureCount != 1 {
+		t.Fatalf("failure count = %d, want 1", got.FailureCount)
+	}
+	if got.LatestBlockHeight != 100 {
+		t.Fatalf("latest block height = %d, want 100", got.LatestBlockHeight)
+	}
+	if got.LastSyncAt.Before(start) {
+		t.Fatalf("last sync at = %s, want after %s", got.LastSyncAt, start)
+	}
+}
+
+func TestRpcRuntimeStatsIgnoresEmptyNetworkAndInvalidHeight(t *testing.T) {
+	ResetRpcRuntimeStatsForTest()
+	t.Cleanup(ResetRpcRuntimeStatsForTest)
+
+	RecordRpcSuccess("")
+	RecordRpcFailure(" ")
+	RecordRpcBlockHeight("tron", 0)
+
+	stats := SnapshotRpcRuntimeStats()
+	if len(stats) != 0 {
+		t.Fatalf("stats = %#v, want empty", stats)
+	}
+}
+
+func TestRpcRuntimeStatsBlockHeightUpdatesLastSyncAt(t *testing.T) {
+	ResetRpcRuntimeStatsForTest()
+	t.Cleanup(ResetRpcRuntimeStatsForTest)
+
+	start := time.Now()
+	RecordRpcBlockHeight("ethereum", 123)
+
+	stats := SnapshotRpcRuntimeStats()
+	got := stats["ethereum"]
+	if got.SuccessCount != 0 {
+		t.Fatalf("success count = %d, want 0", got.SuccessCount)
+	}
+	if got.LastSyncAt.Before(start) {
+		t.Fatalf("last sync at = %s, want after %s", got.LastSyncAt, start)
+	}
+}
+
+func TestResetRpcRuntimeStatsForTest(t *testing.T) {
+	ResetRpcRuntimeStatsForTest()
+	RecordRpcSuccess("tron")
+	ResetRpcRuntimeStatsForTest()
+
+	stats := SnapshotRpcRuntimeStats()
+	if len(stats) != 0 {
+		t.Fatalf("stats = %#v, want empty after reset", stats)
+	}
+}

src/model/data/settings_data.go

@@ -144,9 +144,11 @@ func SetSetting(group, key, value, valueType string) error {
 		valueType = mdb.SettingTypeString
 	}
 	row := mdb.Setting{Group: group, Key: key, Value: value, Type: valueType}
+	updates := clause.AssignmentColumns([]string{"group", "value", "type", "updated_at"})
+	updates = append(updates, clause.Assignment{Column: clause.Column{Name: "deleted_at"}, Value: nil})
 	err := dao.Mdb.Clauses(clause.OnConflict{
 		Columns:   []clause.Column{{Name: "key"}},
-		DoUpdates: clause.AssignmentColumns([]string{"group", "value", "type", "updated_at"}),
+		DoUpdates: updates,
 	}).Create(&row).Error
 	if err != nil {
 		return err

src/model/data/wallet_address_data.go

@@ -5,6 +5,7 @@ import (
 
 	"github.com/GMWalletApp/epusdt/model/dao"
 	"github.com/GMWalletApp/epusdt/model/mdb"
+	addressutil "github.com/GMWalletApp/epusdt/util/address"
 	"github.com/GMWalletApp/epusdt/util/constant"
 )
 
@@ -34,10 +35,23 @@ func normalizeWalletAddressByNetwork(network, address string) string {
 	return address
 }
 
+func normalizeWalletAddressByNetworkE(network, address string) (string, error) {
+	network = normalizeWalletNetwork(network)
+	address = strings.TrimSpace(address)
+	if network == mdb.NetworkTon {
+		return addressutil.NormalizeTonAddress(address)
+	}
+	return normalizeWalletAddressByNetwork(network, address), nil
+}
+
 // AddWalletAddressWithNetwork 创建指定网络的钱包地址
 func AddWalletAddressWithNetwork(network, address string) (*mdb.WalletAddress, error) {
 	network = normalizeWalletNetwork(network)
-	address = normalizeWalletAddressByNetwork(network, address)
+	var err error
+	address, err = normalizeWalletAddressByNetworkE(network, address)
+	if err != nil {
+		return nil, err
+	}
 
 	exist, err := GetWalletAddressByNetworkAndAddress(network, address)
 	if err != nil {
@@ -75,9 +89,13 @@ func AddWalletAddressWithNetwork(network, address string) (*mdb.WalletAddress, e
 // GetWalletAddressByNetworkAndAddress 通过网络和地址查询
 func GetWalletAddressByNetworkAndAddress(network, address string) (*mdb.WalletAddress, error) {
 	network = normalizeWalletNetwork(network)
-	address = normalizeWalletAddressByNetwork(network, address)
+	var err error
+	address, err = normalizeWalletAddressByNetworkE(network, address)
+	if err != nil {
+		return nil, err
+	}
 	walletAddress := new(mdb.WalletAddress)
-	err := dao.Mdb.Model(walletAddress).
+	err = dao.Mdb.Model(walletAddress).
 		Where("network = ?", network).
 		Where("address = ?", address).
 		Limit(1).Find(walletAddress).Error
@@ -126,6 +144,12 @@ func GetAvailableWalletAddressByNetwork(network string) ([]mdb.WalletAddress, er
 		for i := range list {
 			list[i].Address = strings.ToLower(strings.TrimSpace(list[i].Address))
 		}
+	} else if network == mdb.NetworkTon {
+		for i := range list {
+			if normalized, err := addressutil.NormalizeTonAddress(list[i].Address); err == nil {
+				list[i].Address = normalized
+			}
+		}
 	}
 	return list, err
 }
@@ -149,6 +173,12 @@ func GetAllWalletAddressByNetwork(network string) ([]mdb.WalletAddress, error) {
 		for i := range list {
 			list[i].Address = strings.ToLower(strings.TrimSpace(list[i].Address))
 		}
+	} else if network == mdb.NetworkTon {
+		for i := range list {
+			if normalized, err := addressutil.NormalizeTonAddress(list[i].Address); err == nil {
+				list[i].Address = normalized
+			}
+		}
 	}
 	return list, err
 }

src/model/data/wallet_address_data_test.go

@@ -7,6 +7,8 @@ import (
 	"github.com/GMWalletApp/epusdt/internal/testutil"
 	"github.com/GMWalletApp/epusdt/model/dao"
 	"github.com/GMWalletApp/epusdt/model/mdb"
+	"github.com/GMWalletApp/epusdt/util/constant"
+	"github.com/xssnick/tonutils-go/address"
 )
 
 func TestAddWalletAddressWithNetworkNormalizesEvmAddressToLowercase(t *testing.T) {
@@ -81,3 +83,23 @@ func TestAddWalletAddressWithNetworkKeepsOriginalCaseForNonEvm(t *testing.T) {
 		t.Fatalf("solana wallet address = %q, want %q", solRow.Address, solAddress)
 	}
 }
+
+func TestAddWalletAddressWithNetworkNormalizesTonAddressVariants(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+
+	bounceable := "EQC6KV4zs8TJtSZapOrRFmqSkxzpq-oSCoxekQRKElf4nC1I"
+	addr := address.MustParseAddr(bounceable)
+	expected := addr.Bounce(false).String()
+
+	row, err := AddWalletAddressWithNetwork(mdb.NetworkTon, addr.StringRaw())
+	if err != nil {
+		t.Fatalf("add raw ton wallet: %v", err)
+	}
+	if row.Address != expected {
+		t.Fatalf("stored TON address = %q, want %q", row.Address, expected)
+	}
+	if _, err = AddWalletAddressWithNetwork(mdb.NetworkTon, bounceable); err != constant.WalletAddressAlreadyExists {
+		t.Fatalf("add equivalent ton wallet error = %v, want already exists", err)
+	}
+}

src/model/mdb/orders_mdb.go

@@ -4,12 +4,21 @@ const (
 	StatusWaitPay    = 1
 	StatusPaySuccess = 2
 	StatusExpired    = 3
+	// StatusWaitSelect is a placeholder order waiting for the payer to choose
+	// token+network or a hosted provider such as OkPay. It is not payable until
+	// switch-network moves it to StatusWaitPay.
+	StatusWaitSelect  = 4
 	CallBackConfirmOk = 1
 	CallBackConfirmNo = 2
 )
 
 const (
+	// PaymentTypeEpay is the normalized special payment_type value. Orders
+	// matching it case-insensitively use the legacy EPay callback shape.
 	PaymentTypeEpay = "Epay"
+	// PaymentTypeGmpay is the normalized default for GMPay-created orders.
+	// It uses the default GMPay JSON callback shape.
+	PaymentTypeGmpay = "Gmpay"
 )
 
 const (
@@ -19,14 +28,15 @@ const (
 	// PaymentProviderOkPay means this concrete order record is settled through
 	// the third-party OkayPay/OkPay hosted checkout flow.
 	//
-	// In the current design this is typically used by a switch-network-created
+	// It can be used by a status=4 parent completed in place on first
-	// child order, while the parent order keeps its original merchant-facing
+	// switch-network, or by a switch-network-created child order after the
-	// semantics and callback behavior.
+	// parent is already concrete. Merchant callback shape is still controlled by
+	// PaymentType, not by this provider value.
 	PaymentProviderOkPay = "okpay"
 )
 
 type Orders struct {
-	TradeId            string  `gorm:"column:trade_id;uniqueIndex:orders_trade_id_uindex" json:"trade_id" example:"T2026041612345678"`
+	TradeId            string  `gorm:"column:trade_id;uniqueIndex:orders_trade_id_uindex" json:"trade_id" example:"3nQ9pL2xV7sK1mR8cT4yB_aZ"`
 	OrderId            string  `gorm:"column:order_id;uniqueIndex:orders_order_id_uindex" json:"order_id" example:"ORD20260416001"`
 	ParentTradeId      string  `gorm:"column:parent_trade_id;index:idx_orders_parent_trade_id;default:''" json:"parent_trade_id"`
 	BlockTransactionId string  `gorm:"index:orders_block_transaction_id_index;column:block_transaction_id" json:"block_transaction_id" example:"0xabc123..."`
@@ -36,8 +46,8 @@ type Orders struct {
 	ReceiveAddress     string  `gorm:"column:receive_address" json:"receive_address" example:"TTestTronAddress001"`
 	Token              string  `gorm:"column:token" json:"token" example:"USDT"`
 	Network            string  `gorm:"column:network" json:"network" example:"tron"`
-	// 订单状态 1=等待支付 2=支付成功 3=已过期
+	// 订单状态 1=等待支付 2=支付成功 3=已过期 4=等待选择支付网络/币种
-	Status      int    `gorm:"column:status;default:1" json:"status" enums:"1,2,3" example:"1"`
+	Status      int    `gorm:"column:status;default:1" json:"status" enums:"1,2,3,4" example:"1"`
 	NotifyUrl   string `gorm:"column:notify_url" json:"notify_url" example:"https://example.com/notify"`
 	RedirectUrl string `gorm:"column:redirect_url" json:"redirect_url" example:"https://example.com/success"`
 	Name        string `gorm:"column:name" json:"name" example:"VIP月卡"`
@@ -45,12 +55,14 @@ type Orders struct {
 	// 回调确认状态 1=回调成功 2=未回调/回调失败
 	CallBackConfirm int  `gorm:"column:callback_confirm;default:2" json:"callback_confirm" enums:"1,2" example:"2"`
 	IsSelected      bool `gorm:"column:is_selected;default:false" json:"is_selected" example:"false"`
+	// PaymentType is not a channel selector. "Epay" changes callback format
+	// to legacy EPay case-insensitively; "Gmpay" uses GMPay JSON.
 	PaymentType string `gorm:"column:payment_type" json:"payment_type" example:"Epay"`
 	// PayProvider identifies how this specific order row is collected.
 	//
 	// Semantics:
-	//   - parent orders and regular chain child orders use on_chain
+	//   - chain parent orders and regular chain child orders use on_chain
-	//   - third-party hosted checkout child orders use their provider name
+	//   - third-party hosted checkout rows use their provider name
 	//     (for example okpay)
 	//
 	// Existing rows default to on_chain for backward compatibility so upgrades

src/model/mdb/provider_order.go

@@ -9,8 +9,8 @@ const (
 )
 
 // ProviderOrder stores provider-specific checkout data for one internal order
-// row. For OkPay this is expected to bind to the concrete child order created
+// row. For OkPay this can bind either to a status=4 parent completed in place
-// by switch-network, not to the parent merchant order.
+// or to a concrete child order created by later switch-network calls.
 //
 // Binding rules:
 //   - trade_id always points to orders.trade_id
@@ -23,7 +23,7 @@ const (
 // The main orders table remains the source of truth for merchant-facing state,
 // while this table keeps provider-specific identifiers and callback payloads.
 type ProviderOrder struct {
-	TradeId string `gorm:"column:trade_id;size:32;not null;uniqueIndex:provider_orders_trade_id_provider_uindex,priority:1;index:provider_orders_trade_id_index" json:"trade_id" example:"T2026041612345678"`
+	TradeId string `gorm:"column:trade_id;size:32;not null;uniqueIndex:provider_orders_trade_id_provider_uindex,priority:1;index:provider_orders_trade_id_index" json:"trade_id" example:"3nQ9pL2xV7sK1mR8cT4yB_aZ"`
 	// Provider values should match the bound Orders.PayProvider value.
 	Provider string `gorm:"column:provider;size:32;not null;uniqueIndex:provider_orders_trade_id_provider_uindex,priority:2;index:provider_orders_provider_status_index,priority:1" json:"provider" example:"okpay"`
 	// ProviderOrderID is the downstream provider's own order identifier for the

src/model/mdb/rpc_node.go

@@ -5,6 +5,7 @@ import "github.com/dromara/carbon/v2"
 const (
 	RpcNodeTypeHttp = "http"
 	RpcNodeTypeWs   = "ws"
+	RpcNodeTypeLite = "lite"
 )
 
 const (
@@ -13,17 +14,24 @@ const (
 	RpcNodeStatusDown    = "down"
 )
 
-// RpcNode records one RPC endpoint for a network. Clients select a node
+const (
-// by weight among rows where Enabled=true AND Status=ok. A periodic
+	RpcNodePurposeGeneral      = "general"
-// task/rpc_health_job writes Status/LastLatencyMs/LastCheckedAt.
+	RpcNodePurposeManualVerify = "manual_verify"
+	RpcNodePurposeBoth         = "both"
+)
+
+// RpcNode records one RPC endpoint for a network. Runtime selection filters by
+// Type, Status and Purpose so paid manual-verification nodes stay isolated.
 type RpcNode struct {
 	Network string `gorm:"column:network;size:32;index:rpc_nodes_network_status_index,priority:1" json:"network" example:"tron"`
 	Url     string `gorm:"column:url;size:512" json:"url" example:"https://api.trongrid.io"`
-	// 连接类型 http=HTTP请求 ws=WebSocket长连接
+	// 连接类型 http=HTTP请求 ws=WebSocket长连接 lite=TON liteserver配置
-	Type string `gorm:"column:type;size:16" json:"type" enums:"http,ws" example:"http"`
+	Type    string `gorm:"column:type;size:16" json:"type" enums:"http,ws,lite" example:"http"`
 	Weight  int    `gorm:"column:weight;default:1" json:"weight" example:"1"`
 	ApiKey  string `gorm:"column:api_key;size:255" json:"api_key" example:"your-api-key"`
 	Enabled bool   `gorm:"column:enabled;default:true" json:"enabled" example:"true"`
+	// 用途 general=通用 manual_verify=补单专用 both=通用+补单
+	Purpose string `gorm:"column:purpose;size:32;default:general;index:rpc_nodes_purpose_index" json:"purpose" enums:"general,manual_verify,both" example:"general"`
 	// 健康状态 unknown=未知 ok=正常 down=异常
 	Status        string      `gorm:"column:status;size:16;default:unknown;index:rpc_nodes_network_status_index,priority:2" json:"status" enums:"unknown,ok,down" example:"ok"`
 	LastLatencyMs int         `gorm:"column:last_latency_ms;default:-1" json:"last_latency_ms" example:"120"`

src/model/mdb/settings.go

@@ -4,10 +4,10 @@ package mdb
 // Groups: brand, rate, system, epay, okpay. Merchant credentials (pid +
 // secret_key) live in the api_keys table; notification configs live in
 // NotificationChannel.
-// Default rows for the epay/okpay groups are seeded on first startup (see
+// Default rows for the system/epay/okpay groups are seeded on first startup
-// model/dao/mdb_table_init.go seedDefaultSettings). All other groups start
+// (see model/dao/mdb_table_init.go seedDefaultSettings). Other groups start
-// empty and fall back to hardcoded defaults until an admin sets them.
+// empty and fall back to hardcoded defaults until an admin sets them. The
-// Only exception: system.jwt_secret is auto-generated on first startup.
+// system.jwt_secret key is auto-generated on first startup.
 const (
 	SettingGroupBrand  = "brand"
 	SettingGroupRate   = "rate"
@@ -31,6 +31,7 @@ const (
 	SettingKeyInitAdminPasswordChanged = "system.init_admin_password_changed"
 	SettingKeyOrderExpiration          = "system.order_expiration_time"
 	SettingKeyAmountPrecision          = "system.amount_precision"
+	SettingKeySystemLogLevel           = "system.log_level"
 	SettingKeyBrandCheckoutName        = "brand.checkout_name"
 	SettingKeyBrandSiteName            = "brand.site_name"
 	SettingKeyBrandLogoUrl             = "brand.logo_url"
@@ -41,7 +42,7 @@ const (
 	SettingKeyBrandSupportUrl          = "brand.support_url"
 	SettingKeyBrandBackgroundColor     = "brand.background_color"
 	SettingKeyBrandBackgroundImageUrl  = "brand.background_image_url"
-	SettingKeyRateForcedUsdt           = "rate.forced_usdt_rate"
+	SettingKeyRateForcedRateList       = "rate.forced_rate_list"
 	SettingKeyRateAdjustPercent        = "rate.adjust_percent"
 	SettingKeyRateOkxC2cEnabled        = "rate.okx_c2c_enabled"
 	SettingKeyRateApiUrl               = "rate.api_url"
@@ -62,12 +63,16 @@ const (
 	SettingKeyOkPayAllowTokens    = "okpay.allow_tokens"
 )
 
+const (
+	SettingDefaultSystemLogLevel = "error"
+)
+
 type Setting struct {
 	Group       string `gorm:"column:group;size:32;index:settings_group_index" json:"group" enums:"brand,rate,system,epay,okpay" example:"rate"`
-	Key         string `gorm:"column:key;uniqueIndex:settings_key_uindex;size:128" json:"key" example:"rate.forced_usdt_rate"`
+	Key         string `gorm:"column:key;uniqueIndex:settings_key_uindex;size:128" json:"key" example:"rate.forced_rate_list"`
-	Value       string `gorm:"column:value;type:text" json:"value" example:"7.2"`
+	Value       string `gorm:"column:value;type:text" json:"value" example:"{\"cny\":{\"usdt\":0.14635}}"`
-	Type        string `gorm:"column:type;size:16;default:string" json:"type" enums:"string,int,bool,json" example:"string"`
+	Type        string `gorm:"column:type;size:16;default:string" json:"type" enums:"string,int,bool,json" example:"json"`
-	Description string `gorm:"column:description;size:255" json:"description" example:"强制USDT汇率"`
+	Description string `gorm:"column:description;size:255" json:"description" example:"强制汇率列表"`
 	BaseModel
 }
 

src/model/mdb/wallet_address_mdb.go

@@ -12,6 +12,7 @@ const (
 	NetworkBsc      = "binance"
 	NetworkPolygon  = "polygon"
 	NetworkPlasma   = "plasma"
+	NetworkTon      = "ton"
 )
 
 const (

src/model/request/order_request.go

@@ -6,13 +6,17 @@ import "github.com/gookit/validate"
 type CreateTransactionRequest struct {
 	OrderId     string  `json:"order_id" form:"order_id" validate:"required|maxLen:32" example:"ORD20260416001"`
 	Currency    string  `json:"currency" form:"currency" validate:"required" example:"cny"` // 法币 如：cny
-	Token       string  `json:"token" form:"token" validate:"required" example:"usdt"`      // 币种 如：usdt
+	Token       string  `json:"token" form:"token" example:"usdt"`                          // 币种 如：usdt、ton；可与 network 同时缺省创建占位订单
-	Network     string  `json:"network" form:"network" validate:"required" example:"tron"`  // 网络 如：tron
+	Network     string  `json:"network" form:"network" example:"tron"`                      // 网络 如：ton、tron；可与 token 同时缺省创建占位订单
 	Amount      float64 `json:"amount" form:"amount" validate:"required|isFloat|gt:0.01" example:"100.00"`
 	NotifyUrl   string  `json:"notify_url" form:"notify_url" validate:"required" example:"https://example.com/notify"`
 	Signature   string  `json:"signature" form:"signature" validate:"required" example:"a1b2c3d4e5f6..."`
 	RedirectUrl string  `json:"redirect_url" form:"redirect_url" example:"https://example.com/success"`
 	Name        string  `json:"name" form:"name" example:"VIP月卡"`
+	// PaymentType is a compatibility flag, not a gateway selector. Only
+	// "Epay" (case-insensitive) switches callback format to legacy EPay;
+	// empty or any other value is stored as "Gmpay" and uses GMPay JSON.
+	// It is optional for GMPay, but must be included in the signature when sent.
 	PaymentType string `json:"payment_type" form:"payment_type" example:"Epay"`
 }
 
@@ -39,9 +43,20 @@ type OrderProcessingRequest struct {
 	BlockTransactionId string
 }
 
+// ManualPaymentRequest 手动提交交易 hash 补单
+type ManualPaymentRequest struct {
+	BlockTransactionId string `json:"block_transaction_id" validate:"required" example:"0xabc123def456..."`
+}
+
+func (r ManualPaymentRequest) Translates() map[string]string {
+	return validate.MS{
+		"BlockTransactionId": "交易哈希",
+	}
+}
+
 // SwitchNetworkRequest 切换支付网络
 type SwitchNetworkRequest struct {
-	TradeId string `json:"trade_id" validate:"required" example:"T2026041612345678"`
+	TradeId string `json:"trade_id" validate:"required" example:"3nQ9pL2xV7sK1mR8cT4yB_aZ"`
 	Token   string `json:"token" validate:"required" example:"USDT"`
 	Network string `json:"network" validate:"required" example:"okpay,tron,solana,ethereum"`
 }

src/model/response/base.go

@@ -4,8 +4,11 @@ package response
 // Used for swagger documentation only — the actual response is built
 // by util/http.Resp.
 type ApiResponse struct {
+	// Stable errno used by the frontend for i18n. Success is 200; failures use codes from util/constant.Errno.
 	StatusCode int `json:"status_code" example:"200"`
+	// Default server-side errno text. Frontend should prefer status_code for display translation.
 	Message string      `json:"message" example:"success"`
 	Data    interface{} `json:"data"`
+	// Request id echoed from X-Request-ID when present.
 	RequestID string `json:"request_id" example:"req-123456"`
 }

src/model/response/order_response.go

@@ -2,21 +2,22 @@ package response
 
 // CreateTransactionResponse 创建订单成功返回
 type CreateTransactionResponse struct {
-	TradeId        string  `json:"trade_id" example:"T2026041612345678"`                                     //  epusdt订单号
+	TradeId        string  `json:"trade_id" example:"3nQ9pL2xV7sK1mR8cT4yB_aZ"`                                     //  epusdt订单号
 	OrderId        string  `json:"order_id" example:"ORD20260416001"`                                               //  客户交易id
 	Amount         float64 `json:"amount" example:"100.0000"`                                                       //  订单金额，按 system.amount_precision 保留小数
 	Currency       string  `json:"currency" example:"CNY"`                                                          //  订单货币类型 CNY USD......
 	ActualAmount   float64 `json:"actual_amount" example:"14.2857"`                                                 //  订单实际需要支付的金额，按 system.amount_precision 保留小数
 	ReceiveAddress string  `json:"receive_address" example:"TTestTronAddress001"`                                   //  收款钱包地址
 	Token          string  `json:"token" example:"USDT"`                                                            // 所属币种 TRX USDT......
+	Status         int     `json:"status" enums:"1,2,3,4" example:"1"`                                              // 订单状态 1=等待支付 2=支付成功 3=已过期 4=等待选择支付网络/币种
 	ExpirationTime int64   `json:"expiration_time" example:"1713264600"`                                            // 过期时间 时间戳
-	PaymentUrl     string  `json:"payment_url" example:"https://pay.example.com/checkout/T2026041612345678"` // 收银台地址
+	PaymentUrl     string  `json:"payment_url" example:"https://pay.example.com/checkout/3nQ9pL2xV7sK1mR8cT4yB_aZ"` // 收银台地址
 }
 
 // OrderNotifyResponse 订单异步回调结构体
 type OrderNotifyResponse struct {
 	Pid                string  `json:"pid" example:"1000"`                            //  签名使用的商户 PID，商户据此查本地 secret 验签
-	TradeId            string  `json:"trade_id" example:"T2026041612345678"`          //  epusdt订单号
+	TradeId            string  `json:"trade_id" example:"3nQ9pL2xV7sK1mR8cT4yB_aZ"`   //  epusdt订单号
 	OrderId            string  `json:"order_id" example:"ORD20260416001"`             //  客户交易id
 	Amount             float64 `json:"amount" example:"100.0000"`                     //  订单金额，按 system.amount_precision 保留小数
 	ActualAmount       float64 `json:"actual_amount" example:"14.2857"`               //  订单实际需要支付的金额，按 system.amount_precision 保留小数
@@ -31,7 +32,7 @@ type OrderNotifyResponse struct {
 // OrderNotifyResponseEpay epay订单异步回调结构体
 type OrderNotifyResponseEpay struct {
 	PID         int    `json:"pid" example:"1001"`                          // 商户ID
-	TradeNo     string `json:"trade_no" example:"T2026041612345678"`  // 平台订单号
+	TradeNo     string `json:"trade_no" example:"3nQ9pL2xV7sK1mR8cT4yB_aZ"` // 平台订单号
 	OutTradeNo  string `json:"out_trade_no" example:"ORD20260416001"`       // 商户订单号
 	Type        string `json:"type" example:"usdt"`                         // 订单类型
 	Name        string `json:"name" example:"VIP月卡"`                        // 商品名称

src/model/response/pay_response.go

@@ -1,22 +1,30 @@
 package response
 
 type CheckoutCounterResponse struct {
-	TradeId        string  `json:"trade_id" example:"T2026041612345678"`          //  epusdt订单号
+	TradeId        string  `json:"trade_id" example:"3nQ9pL2xV7sK1mR8cT4yB_aZ"`                                     //  epusdt订单号
 	Amount         float64 `json:"amount" example:"100.0000"`                                                       //  订单金额，按 system.amount_precision 保留小数 法币金额
-	ActualAmount   float64 `json:"actual_amount" example:"14.2857"`               //  订单实际需要支付的金额，按 system.amount_precision 保留小数 加密货币金额
+	ActualAmount   float64 `json:"actual_amount" example:"14.2857"`                                                 //  订单实际需要支付的金额；status=4 占位订单返回 0
-	Token          string  `json:"token" example:"USDT"`                          //  所属币种 TRX USDT......
+	Token          string  `json:"token" example:"USDT"`                                                            //  所属币种；status=4 占位订单为空
 	Currency       string  `json:"currency" example:"CNY"`                                                          //  法币币种 CNY USD ...
-	ReceiveAddress string  `json:"receive_address" example:"TTestTronAddress001"` //  收款钱包地址
+	ReceiveAddress string  `json:"receive_address" example:"TTestTronAddress001"`                                   //  收款钱包地址；status=4 占位订单为空
-	Network        string  `json:"network" example:"tron"`                        //  网络 TRON ETH ...
+	Network        string  `json:"network" example:"tron"`                                                          //  网络 TRON ETH；status=4 占位订单为空
+	Status         int     `json:"status" enums:"1,2,3,4" example:"1"`                                              // 订单状态 1=等待支付 2=支付成功 3=已过期 4=等待选择支付网络/币种；status=4 时前端应引导选择链上 token/network 或 OkPay
+	PaymentType    string  `json:"payment_type" enums:"gmpay,epay" example:"gmpay"`                                 // 支付接入类型；底层 Epay/Gmpay 转为小写 epay/gmpay 返回
 	ExpirationTime int64   `json:"expiration_time" example:"1713264600"`                                            // 过期时间 时间戳
-	RedirectUrl    string  `json:"redirect_url" example:"https://example.com/success"`
+	RedirectUrl    string  `json:"redirect_url" example:"https://example.com/success"`                              // 非 EPay 时为商户原始回跳地址；EPay 时为内部中转地址 /pay/return/{trade_id}
-	PaymentUrl     string  `json:"payment_url" example:"https://pay.example.com/checkout/T2026041612345678"` // 支付链接；链上订单通常为本地收银台，OkPay 子订单为第三方 payLink
+	PaymentUrl     string  `json:"payment_url" example:"https://pay.example.com/checkout/3nQ9pL2xV7sK1mR8cT4yB_aZ"` // 支付链接；链上订单为空，OkPay 订单为第三方 payLink
 	CreatedAt      int64   `json:"created_at" example:"1713264000"`                                                 // 订单创建时间 时间戳
-	IsSelected     bool    `json:"is_selected" example:"false"`
+	IsSelected     bool    `json:"is_selected" example:"false"`                                                     // 是否已选择当前支付方式；status=4 占位订单和刚补全的占位父单为 false
 }
 
 type CheckStatusResponse struct {
-	TradeId string `json:"trade_id" example:"T2026041612345678"` //  epusdt订单号
+	TradeId string `json:"trade_id" example:"3nQ9pL2xV7sK1mR8cT4yB_aZ"` //  epusdt订单号
-	// 订单状态 1=等待支付 2=支付成功 3=已过期
+	// 订单状态 1=等待支付 2=支付成功 3=已过期 4=等待选择支付网络/币种
-	Status int `json:"status" enums:"1,2,3" example:"1"`
+	Status int `json:"status" enums:"1,2,3,4" example:"1"`
+}
+
+type ManualPaymentResponse struct {
+	TradeId            string `json:"trade_id" example:"3nQ9pL2xV7sK1mR8cT4yB_aZ"`      // epusdt订单号
+	Status             int    `json:"status" enums:"1,2,3" example:"2"`                 // 订单状态 1=等待支付 2=支付成功 3=已过期
+	BlockTransactionId string `json:"block_transaction_id" example:"0xabc123def456..."` // 已验证并入账的交易哈希
 }

src/model/response/support_response.go

@@ -7,9 +7,9 @@ type NetworkTokenSupport struct {
 }
 
 type EpayPublicConfig struct {
-	DefaultToken    string `json:"default_token" example:"usdt"`
+	DefaultToken    string `json:"default_token" example:""`       // EPay default token; empty means submit.php can create a status=4 placeholder when request token/network are also absent.
-	DefaultCurrency string `json:"default_currency" example:"cny"`
+	DefaultCurrency string `json:"default_currency" example:"cny"` // EPay default fiat currency; falls back to cny when unset.
-	DefaultNetwork  string `json:"default_network" example:"tron"`
+	DefaultNetwork  string `json:"default_network" example:""`     // EPay default network; empty means submit.php can create a status=4 placeholder when request token/network are also absent.
 }
 
 type SitePublicConfig struct {
@@ -37,4 +37,5 @@ type PublicConfigResponse struct {
 	Site            SitePublicConfig      `json:"site"`
 	Epay            EpayPublicConfig      `json:"epay"`
 	OkPay           OkPayPublicConfig     `json:"okpay"`
+	Version         string                `json:"version" example:"v1.0.1"`
 }

src/model/service/epay_return.go

@@ -0,0 +1,167 @@
+package service
+
+import (
+	"fmt"
+	"net/url"
+	"strconv"
+	"strings"
+
+	"github.com/GMWalletApp/epusdt/config"
+	"github.com/GMWalletApp/epusdt/model/data"
+	"github.com/GMWalletApp/epusdt/model/mdb"
+	"github.com/GMWalletApp/epusdt/model/response"
+	"github.com/GMWalletApp/epusdt/util/constant"
+	"github.com/GMWalletApp/epusdt/util/sign"
+)
+
+type EPayReturnRedirect struct {
+	TargetURL          string
+	IsMerchantRedirect bool
+}
+
+func isEPayOrder(order *mdb.Orders) bool {
+	return order != nil && strings.EqualFold(order.PaymentType, mdb.PaymentTypeEpay)
+}
+
+func buildCheckoutCounterPath(tradeID string) string {
+	return "/pay/checkout-counter/" + tradeID
+}
+
+func buildAbsoluteAppURL(path string) string {
+	path = strings.TrimSpace(path)
+	if path == "" {
+		return ""
+	}
+	if !strings.HasPrefix(path, "/") {
+		path = "/" + path
+	}
+	base := strings.TrimRight(strings.TrimSpace(config.GetAppUri()), "/")
+	if base == "" {
+		return path
+	}
+	return base + path
+}
+
+func buildEPayReturnPath(tradeID string) string {
+	return "/pay/return/" + tradeID
+}
+
+func buildPublicRedirectURL(order *mdb.Orders) string {
+	if order == nil {
+		return ""
+	}
+	raw := strings.TrimSpace(order.RedirectUrl)
+	if raw == "" || !isEPayOrder(order) {
+		return raw
+	}
+	return buildAbsoluteAppURL(buildEPayReturnPath(order.TradeId))
+}
+
+func ResolveOrderApiKey(order *mdb.Orders) (*mdb.ApiKey, error) {
+	if order == nil || order.ApiKeyID == 0 {
+		return nil, constant.OrderApiKeyUnavailableErr
+	}
+	row, err := data.GetApiKeyByID(order.ApiKeyID)
+	if err != nil {
+		return nil, err
+	}
+	if row == nil || row.ID == 0 || row.Status != mdb.ApiKeyStatusEnable {
+		return nil, constant.OrderApiKeyUnavailableErr
+	}
+	return row, nil
+}
+
+func BuildEPayResultParams(order *mdb.Orders, apiKeyRow *mdb.ApiKey) (map[string]string, error) {
+	if order == nil || apiKeyRow == nil {
+		return nil, constant.EPayReturnSignatureErr
+	}
+
+	pidInt, err := strconv.Atoi(strings.TrimSpace(apiKeyRow.Pid))
+	if err != nil {
+		return nil, constant.EPayReturnSignatureErr
+	}
+
+	notifyData := response.OrderNotifyResponseEpay{
+		PID:         pidInt,
+		TradeNo:     order.TradeId,
+		OutTradeNo:  order.OrderId,
+		Type:        "alipay",
+		Name:        order.Name,
+		Money:       fmt.Sprintf("%.4f", order.Amount),
+		TradeStatus: "TRADE_SUCCESS",
+	}
+
+	signstr, err := sign.Get(notifyData, apiKeyRow.SecretKey)
+	if err != nil {
+		return nil, constant.EPayReturnSignatureErr
+	}
+
+	return map[string]string{
+		"pid":          strconv.Itoa(pidInt),
+		"trade_no":     notifyData.TradeNo,
+		"out_trade_no": notifyData.OutTradeNo,
+		"type":         notifyData.Type,
+		"name":         notifyData.Name,
+		"money":        notifyData.Money,
+		"trade_status": notifyData.TradeStatus,
+		"sign":         signstr,
+		"sign_type":    "MD5",
+	}, nil
+}
+
+func appendQueryParams(rawURL string, params map[string]string) (string, error) {
+	rawURL = strings.TrimSpace(rawURL)
+	if rawURL == "" {
+		return "", constant.OrderRedirectURLErr
+	}
+
+	targetURL, err := url.Parse(rawURL)
+	if err != nil {
+		return "", constant.OrderRedirectURLErr
+	}
+
+	query := targetURL.Query()
+	for key, value := range params {
+		query.Set(key, value)
+	}
+	targetURL.RawQuery = query.Encode()
+	return targetURL.String(), nil
+}
+
+func ResolveEPayReturnRedirect(tradeID string) (*EPayReturnRedirect, error) {
+	order, err := GetOrderInfoByTradeId(tradeID)
+	if err != nil {
+		return nil, err
+	}
+
+	if !isEPayOrder(order) || order.Status != mdb.StatusPaySuccess {
+		return &EPayReturnRedirect{
+			TargetURL: buildCheckoutCounterPath(order.TradeId),
+		}, nil
+	}
+
+	rawMerchantURL := strings.TrimSpace(order.RedirectUrl)
+	if rawMerchantURL == "" {
+		return nil, constant.OrderRedirectURLErr
+	}
+
+	apiKeyRow, err := ResolveOrderApiKey(order)
+	if err != nil {
+		return nil, err
+	}
+
+	params, err := BuildEPayResultParams(order, apiKeyRow)
+	if err != nil {
+		return nil, err
+	}
+
+	targetURL, err := appendQueryParams(rawMerchantURL, params)
+	if err != nil {
+		return nil, err
+	}
+
+	return &EPayReturnRedirect{
+		TargetURL:          targetURL,
+		IsMerchantRedirect: true,
+	}, nil
+}

src/model/service/epay_return_test.go

@@ -0,0 +1,155 @@
+package service
+
+import (
+	"net/url"
+	"testing"
+
+	"github.com/GMWalletApp/epusdt/config"
+	"github.com/GMWalletApp/epusdt/internal/testutil"
+	"github.com/GMWalletApp/epusdt/model/dao"
+	"github.com/GMWalletApp/epusdt/model/mdb"
+	"github.com/GMWalletApp/epusdt/util/constant"
+	"github.com/GMWalletApp/epusdt/util/sign"
+)
+
+func TestBuildPublicRedirectURLRewritesOnlyEpayOrders(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+
+	epayOrder := &mdb.Orders{
+		TradeId:     "trade_epay_redirect",
+		PaymentType: mdb.PaymentTypeEpay,
+		RedirectUrl: "https://merchant.example/return",
+	}
+	wantRedirect := config.GetAppUri() + "/pay/return/trade_epay_redirect"
+	if got := buildPublicRedirectURL(epayOrder); got != wantRedirect {
+		t.Fatalf("epay redirect_url = %q, want internal return route", got)
+	}
+
+	gmpayOrder := &mdb.Orders{
+		TradeId:     "trade_gmpay_redirect",
+		PaymentType: mdb.PaymentTypeGmpay,
+		RedirectUrl: "https://merchant.example/return",
+	}
+	if got := buildPublicRedirectURL(gmpayOrder); got != "https://merchant.example/return" {
+		t.Fatalf("gmpay redirect_url = %q, want merchant raw redirect_url", got)
+	}
+
+	if got := buildPublicRedirectURL(&mdb.Orders{TradeId: "trade_empty", PaymentType: mdb.PaymentTypeEpay}); got != "" {
+		t.Fatalf("empty redirect_url = %q, want empty", got)
+	}
+}
+
+func TestBuildEPayResultParamsMatchesLegacyFields(t *testing.T) {
+	params, err := BuildEPayResultParams(&mdb.Orders{
+		TradeId: "trade_epay_params",
+		OrderId: "order_epay_params",
+		Name:    "VIP",
+		Amount:  1,
+	}, &mdb.ApiKey{
+		Pid:       "1001",
+		SecretKey: "epay-secret",
+	})
+	if err != nil {
+		t.Fatalf("BuildEPayResultParams(): %v", err)
+	}
+
+	expected := map[string]string{
+		"pid":          "1001",
+		"trade_no":     "trade_epay_params",
+		"out_trade_no": "order_epay_params",
+		"type":         "alipay",
+		"name":         "VIP",
+		"money":        "1.0000",
+		"trade_status": "TRADE_SUCCESS",
+		"sign_type":    "MD5",
+	}
+	for key, want := range expected {
+		if got := params[key]; got != want {
+			t.Fatalf("%s = %q, want %q", key, got, want)
+		}
+	}
+
+	signParams := map[string]interface{}{
+		"pid":          params["pid"],
+		"trade_no":     params["trade_no"],
+		"out_trade_no": params["out_trade_no"],
+		"type":         params["type"],
+		"name":         params["name"],
+		"money":        params["money"],
+		"trade_status": params["trade_status"],
+	}
+	wantSign, err := sign.Get(signParams, "epay-secret")
+	if err != nil {
+		t.Fatalf("sign.Get(): %v", err)
+	}
+	if got := params["sign"]; got != wantSign {
+		t.Fatalf("sign = %q, want %q", got, wantSign)
+	}
+}
+
+func TestBuildEPayResultParamsRejectsNonNumericPid(t *testing.T) {
+	_, err := BuildEPayResultParams(&mdb.Orders{
+		TradeId: "trade_bad_pid",
+		OrderId: "order_bad_pid",
+		Name:    "VIP",
+		Amount:  1,
+	}, &mdb.ApiKey{
+		Pid:       "not-a-number",
+		SecretKey: "epay-secret",
+	})
+	if err != constant.EPayReturnSignatureErr {
+		t.Fatalf("error = %v, want %v", err, constant.EPayReturnSignatureErr)
+	}
+}
+
+func TestResolveOrderApiKeyRejectsUnavailableRows(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+
+	if _, err := ResolveOrderApiKey(&mdb.Orders{TradeId: "missing_api_key_id"}); err != constant.OrderApiKeyUnavailableErr {
+		t.Fatalf("missing api_key_id error = %v, want %v", err, constant.OrderApiKeyUnavailableErr)
+	}
+
+	row := &mdb.ApiKey{
+		Name:      "disabled",
+		Pid:       "1201",
+		SecretKey: "disabled-secret",
+		Status:    mdb.ApiKeyStatusDisable,
+	}
+	if err := dao.Mdb.Create(row).Error; err != nil {
+		t.Fatalf("create disabled api key: %v", err)
+	}
+	if _, err := ResolveOrderApiKey(&mdb.Orders{TradeId: "disabled_api_key", ApiKeyID: row.ID}); err != constant.OrderApiKeyUnavailableErr {
+		t.Fatalf("disabled api key error = %v, want %v", err, constant.OrderApiKeyUnavailableErr)
+	}
+}
+
+func TestAppendQueryParamsPreservesMerchantQuery(t *testing.T) {
+	target, err := appendQueryParams("https://merchant.example/return?from=merchant", map[string]string{
+		"pid":          "1001",
+		"trade_no":     "trade_epay_redirect",
+		"trade_status": "TRADE_SUCCESS",
+	})
+	if err != nil {
+		t.Fatalf("appendQueryParams(): %v", err)
+	}
+
+	parsed, err := url.Parse(target)
+	if err != nil {
+		t.Fatalf("url.Parse(): %v", err)
+	}
+	query := parsed.Query()
+	if got := query.Get("from"); got != "merchant" {
+		t.Fatalf("from = %q, want merchant", got)
+	}
+	if got := query.Get("pid"); got != "1001" {
+		t.Fatalf("pid = %q, want 1001", got)
+	}
+	if got := query.Get("trade_no"); got != "trade_epay_redirect" {
+		t.Fatalf("trade_no = %q, want trade_epay_redirect", got)
+	}
+	if got := query.Get("trade_status"); got != "TRADE_SUCCESS" {
+		t.Fatalf("trade_status = %q, want TRADE_SUCCESS", got)
+	}
+}

src/model/service/manual_payment_verify.go

@@ -16,6 +16,7 @@ import (
 	tron "github.com/GMWalletApp/epusdt/crypto"
 	"github.com/GMWalletApp/epusdt/model/data"
 	"github.com/GMWalletApp/epusdt/model/mdb"
+	addressutil "github.com/GMWalletApp/epusdt/util/address"
 	"github.com/GMWalletApp/epusdt/util/constant"
 	"github.com/GMWalletApp/epusdt/util/math"
 	"github.com/ethereum/go-ethereum/common"
@@ -23,6 +24,10 @@ import (
 	"github.com/ethereum/go-ethereum/ethclient"
 	"github.com/shopspring/decimal"
 	"github.com/tidwall/gjson"
+	"github.com/xssnick/tonutils-go/address"
+	"github.com/xssnick/tonutils-go/tlb"
+	"github.com/xssnick/tonutils-go/ton"
+	"github.com/xssnick/tonutils-go/ton/jetton"
 )
 
 const manualVerifyRequestTimeout = 15 * time.Second
@@ -54,7 +59,9 @@ func SetManualOrderPaymentValidatorForTest(fn func(*mdb.Orders, string) (string,
 	if fn == nil {
 		manualOrderPaymentValidator = validateManualOrderPaymentDefault
 	} else {
-		manualOrderPaymentValidator = fn
+		manualOrderPaymentValidator = func(order *mdb.Orders, blockTransactionID string) (string, error) {
+			return fn(order, blockTransactionID)
+		}
 	}
 	manualOrderPaymentValidatorMu.Unlock()
 	return func() {
@@ -80,6 +87,8 @@ func validateManualOrderPaymentDefault(order *mdb.Orders, blockTransactionID str
 		canonicalTxID, err = validateManualTronPayment(order, txID)
 	case mdb.NetworkSolana:
 		canonicalTxID, err = validateManualSolanaPayment(order, txID)
+	case mdb.NetworkTon:
+		canonicalTxID, err = validateManualTonPayment(order, txID)
 	case mdb.NetworkEthereum, mdb.NetworkBsc, mdb.NetworkPolygon, mdb.NetworkPlasma:
 		canonicalTxID, err = validateManualEvmPayment(order, txID)
 	default:
@@ -282,25 +291,25 @@ func validateManualEvmPaymentWithClient(ctx context.Context, client evmChainRead
 func dialManualEvmClients(ctx context.Context, network string) ([]manualEvmClient, error) {
 	var clients []manualEvmClient
 	var connectErrors []string
-	for _, nodeType := range []string{mdb.RpcNodeTypeWs, mdb.RpcNodeTypeHttp} {
+
-		node, err := data.SelectRpcNode(network, nodeType)
+	nodes, err := listManualEvmRpcCandidates(network)
 	if err != nil {
 		return nil, err
 	}
-		if node == nil || node.ID == 0 || strings.TrimSpace(node.Url) == "" {
+	for _, node := range nodes {
+		if strings.TrimSpace(node.Url) == "" {
 			continue
 		}
-		rpcURL := strings.TrimSpace(node.Url)
+		client, err := dialManualEvmClient(ctx, node)
-		client, err := ethclient.DialContext(ctx, rpcURL)
 		if err == nil {
 			clients = append(clients, manualEvmClient{
-				label:  fmt.Sprintf("%s %s", nodeType, rpcURL),
+				label:  manualRpcNodeLabel(node),
 				reader: client,
 				close:  client.Close,
 			})
 			continue
 		}
-		connectErrors = append(connectErrors, fmt.Sprintf("%s %s: %v", nodeType, rpcURL, err))
+		connectErrors = append(connectErrors, fmt.Sprintf("%s: %v", manualRpcNodeLabel(node), err))
 	}
 	if len(clients) > 0 {
 		return clients, nil
@@ -311,6 +320,49 @@ func dialManualEvmClients(ctx context.Context, network string) ([]manualEvmClien
 	return nil, fmt.Errorf("no enabled %s WS/HTTP RPC node configured", network)
 }
 
+func listManualEvmRpcCandidates(network string) ([]mdb.RpcNode, error) {
+	buckets := make([][]mdb.RpcNode, 4)
+	for _, nodeType := range []string{mdb.RpcNodeTypeHttp, mdb.RpcNodeTypeWs} {
+		nodes, err := data.ListManualPaymentRpcCandidates(network, nodeType)
+		if err != nil {
+			return nil, err
+		}
+		for _, node := range nodes {
+			node.Purpose = data.NormalizeRpcNodePurpose(node.Purpose)
+			switch node.Purpose {
+			case mdb.RpcNodePurposeGeneral, mdb.RpcNodePurposeBoth:
+				if node.Status == mdb.RpcNodeStatusOk {
+					buckets[0] = append(buckets[0], node)
+				} else {
+					buckets[1] = append(buckets[1], node)
+				}
+			case mdb.RpcNodePurposeManualVerify:
+				if node.Status == mdb.RpcNodeStatusOk {
+					buckets[2] = append(buckets[2], node)
+				} else {
+					buckets[3] = append(buckets[3], node)
+				}
+			}
+		}
+	}
+
+	out := make([]mdb.RpcNode, 0)
+	for _, bucket := range buckets {
+		out = append(out, bucket...)
+	}
+	return out, nil
+}
+
+func dialManualEvmClient(ctx context.Context, node mdb.RpcNode) (*ethclient.Client, error) {
+	rpcURL := strings.TrimSpace(node.Url)
+	return ethclient.DialContext(ctx, rpcURL)
+}
+
+func manualRpcNodeLabel(node mdb.RpcNode) string {
+	purpose := data.NormalizeRpcNodePurpose(node.Purpose)
+	return fmt.Sprintf("%s purpose=%s", data.RpcNodeLogLabel(node), purpose)
+}
+
 func ensureEvmTransactionNotBeforeOrder(blockTime uint64, order *mdb.Orders) error {
 	if order == nil {
 		return fmt.Errorf("order not found")
@@ -398,55 +450,77 @@ func validateManualTronPayment(order *mdb.Orders, txID string) (string, error) {
 		return "", err
 	}
 
-	baseURL, apiKey, err := ResolveTronNode()
+	nodes, err := data.ListManualPaymentRpcCandidates(mdb.NetworkTron, mdb.RpcNodeTypeHttp)
 	if err != nil {
 		return "", err
 	}
+	if len(nodes) == 0 {
+		return "", fmt.Errorf("no enabled %s %s RPC node configured in rpc_nodes", mdb.NetworkTron, mdb.RpcNodeTypeHttp)
+	}
 
+	var verifyErrors []string
+	for _, node := range nodes {
+		if strings.TrimSpace(node.Url) == "" {
+			continue
+		}
+		if err = validateManualTronPaymentWithNode(order, normalizedTxID, node); err != nil {
+			verifyErrors = append(verifyErrors, fmt.Sprintf("%s: %v", manualRpcNodeLabel(node), err))
+			continue
+		}
+		return normalizedTxID, nil
+	}
+	if len(verifyErrors) > 0 {
+		return "", fmt.Errorf("manual TRON verification failed: %s", strings.Join(verifyErrors, "; "))
+	}
+	return "", fmt.Errorf("no enabled %s %s RPC node configured in rpc_nodes", mdb.NetworkTron, mdb.RpcNodeTypeHttp)
+}
+
+func validateManualTronPaymentWithNode(order *mdb.Orders, normalizedTxID string, node mdb.RpcNode) error {
+	baseURL := strings.TrimSpace(node.Url)
 	var tx manualTronTransaction
-	if err = tronPostJSON(baseURL, apiKey, "/wallet/gettransactionbyid", map[string]interface{}{"value": normalizedTxID}, &tx); err != nil {
+	if err := tronPostJSON(baseURL, node.ApiKey, "/wallet/gettransactionbyid", map[string]interface{}{"value": normalizedTxID}, &tx); err != nil {
-		return "", fmt.Errorf("fetch tron transaction: %w", err)
+		return fmt.Errorf("fetch tron transaction: %w", err)
 	}
 	if strings.TrimSpace(tx.TxID) == "" {
-		return "", fmt.Errorf("transaction not found")
+		return fmt.Errorf("transaction not found")
 	}
 	if strings.TrimSpace(tx.TxID) != "" && !strings.EqualFold(strings.TrimSpace(tx.TxID), normalizedTxID) {
-		return "", fmt.Errorf("transaction id mismatch")
+		return fmt.Errorf("transaction id mismatch")
 	}
 	if len(tx.Ret) > 0 && tx.Ret[0].ContractRet != "" && tx.Ret[0].ContractRet != "SUCCESS" {
-		return "", fmt.Errorf("transaction is not successful: %s", tx.Ret[0].ContractRet)
+		return fmt.Errorf("transaction is not successful: %s", tx.Ret[0].ContractRet)
 	}
 
 	var info manualTronTxInfo
-	if err = tronPostJSON(baseURL, apiKey, "/wallet/gettransactioninfobyid", map[string]interface{}{"value": normalizedTxID}, &info); err != nil {
+	if err := tronPostJSON(baseURL, node.ApiKey, "/wallet/gettransactioninfobyid", map[string]interface{}{"value": normalizedTxID}, &info); err != nil {
-		return "", fmt.Errorf("fetch tron transaction info: %w", err)
+		return fmt.Errorf("fetch tron transaction info: %w", err)
 	}
 	if info.BlockNumber <= 0 {
-		return "", fmt.Errorf("transaction is not confirmed")
+		return fmt.Errorf("transaction is not confirmed")
 	}
 	if info.Receipt.Result != "" && info.Receipt.Result != "SUCCESS" {
-		return "", fmt.Errorf("transaction is not successful: %s", info.Receipt.Result)
+		return fmt.Errorf("transaction is not successful: %s", info.Receipt.Result)
 	}
-	if err = ensureTronConfirmations(baseURL, apiKey, order.Network, info.BlockNumber); err != nil {
+	if err := ensureTronConfirmations(baseURL, node.ApiKey, order.Network, info.BlockNumber); err != nil {
-		return "", err
+		return err
 	}
 	if info.BlockTimeStamp <= 0 {
-		return "", fmt.Errorf("transaction block timestamp missing")
+		return fmt.Errorf("transaction block timestamp missing")
 	}
 	if info.BlockTimeStamp < order.CreatedAt.TimestampMilli() {
-		return "", fmt.Errorf("transaction predates the order")
+		return fmt.Errorf("transaction predates the order")
 	}
 
 	if strings.EqualFold(strings.TrimSpace(order.Token), "TRX") {
-		if err = validateManualTronNativeTransfer(order, &tx); err != nil {
+		if err := validateManualTronNativeTransfer(order, &tx); err != nil {
-			return "", err
+			return err
 		}
-		return normalizedTxID, nil
+		return nil
 	}
-	if err = validateManualTronTRC20Transfer(order, &tx, &info); err != nil {
+	if err := validateManualTronTRC20Transfer(order, &tx, &info); err != nil {
-		return "", err
+		return err
 	}
-	return normalizedTxID, nil
+	return nil
 }
 
 func validateManualTronNativeTransfer(order *mdb.Orders, tx *manualTronTransaction) error {
@@ -569,22 +643,289 @@ func tronPostJSON(baseURL, apiKey, path string, body interface{}, out interface{
 	return json.Unmarshal(raw, out)
 }
 
-func validateManualSolanaPayment(order *mdb.Orders, sig string) (string, error) {
+type manualTonTxRef struct {
-	sig = strings.TrimSpace(sig)
+	ReceiveRaw string
-	txData, err := SolGetTransaction(sig)
+	LT         uint64
+	HashHex    string
+	HasLT      bool
+}
+
+func validateManualTonPayment(order *mdb.Orders, txID string) (string, error) {
+	ref, err := parseManualTonTxRef(txID)
 	if err != nil {
-		return "", fmt.Errorf("fetch solana transaction: %w", err)
+		return "", err
 	}
-	if !gjson.GetBytes(txData, "result").Exists() || gjson.GetBytes(txData, "result").Type == gjson.Null {
+	orderAddr, err := addressutil.ParseTonMainnetAddress(order.ReceiveAddress)
+	if err != nil {
+		return "", fmt.Errorf("invalid order receive address: %w", err)
+	}
+	if ref.ReceiveRaw != "" && ref.ReceiveRaw != orderAddr.Raw {
+		return "", fmt.Errorf("transaction recipient mismatch")
+	}
+
+	nodes, err := data.ListManualPaymentRpcCandidates(mdb.NetworkTon, mdb.RpcNodeTypeLite)
+	if err != nil {
+		return "", err
+	}
+	if len(nodes) == 0 {
+		return "", fmt.Errorf("no enabled %s %s RPC node configured in rpc_nodes", mdb.NetworkTon, mdb.RpcNodeTypeLite)
+	}
+
+	var verifyErrors []string
+	for _, node := range nodes {
+		api, closeFn, err := dialManualTonClient(node)
+		if err != nil {
+			verifyErrors = append(verifyErrors, fmt.Sprintf("%s: connect: %v", manualRpcNodeLabel(node), err))
+			continue
+		}
+		canonicalID, err := validateManualTonPaymentWithAPI(context.Background(), api, order, orderAddr.Address, ref)
+		closeFn()
+		if err != nil {
+			verifyErrors = append(verifyErrors, fmt.Sprintf("%s: %v", manualRpcNodeLabel(node), err))
+			continue
+		}
+		return canonicalID, nil
+	}
+	if len(verifyErrors) > 0 {
+		return "", fmt.Errorf("manual TON verification failed: %s", strings.Join(verifyErrors, "; "))
+	}
+	return "", fmt.Errorf("no enabled %s %s RPC node configured in rpc_nodes", mdb.NetworkTon, mdb.RpcNodeTypeLite)
+}
+
+func parseManualTonTxRef(input string) (manualTonTxRef, error) {
+	raw := strings.TrimSpace(input)
+	if raw == "" {
+		return manualTonTxRef{}, fmt.Errorf("block_transaction_id is required")
+	}
+	if strings.HasPrefix(strings.ToLower(raw), "ton:") {
+		body := raw[4:]
+		last := strings.LastIndex(body, ":")
+		if last <= 0 || last == len(body)-1 {
+			return manualTonTxRef{}, fmt.Errorf("invalid ton canonical transaction id")
+		}
+		hashHex, err := normalizeTonTxHashHex(body[last+1:])
+		if err != nil {
+			return manualTonTxRef{}, err
+		}
+		left := body[:last]
+		mid := strings.LastIndex(left, ":")
+		if mid <= 0 || mid == len(left)-1 {
+			return manualTonTxRef{}, fmt.Errorf("invalid ton canonical transaction id")
+		}
+		lt, err := parseUint64Strict(left[mid+1:])
+		if err != nil {
+			return manualTonTxRef{}, fmt.Errorf("invalid ton transaction lt")
+		}
+		receiveRaw, err := addressutil.TonRawAddressKey(left[:mid])
+		if err != nil {
+			return manualTonTxRef{}, fmt.Errorf("invalid ton canonical recipient: %w", err)
+		}
+		return manualTonTxRef{ReceiveRaw: receiveRaw, LT: lt, HashHex: hashHex, HasLT: true}, nil
+	}
+	if idx := strings.Index(raw, ":"); idx > 0 {
+		lt, err := parseUint64Strict(raw[:idx])
+		if err != nil {
+			return manualTonTxRef{}, fmt.Errorf("invalid ton transaction lt")
+		}
+		hashHex, err := normalizeTonTxHashHex(raw[idx+1:])
+		if err != nil {
+			return manualTonTxRef{}, err
+		}
+		return manualTonTxRef{LT: lt, HashHex: hashHex, HasLT: true}, nil
+	}
+	hashHex, err := normalizeTonTxHashHex(raw)
+	if err != nil {
+		return manualTonTxRef{}, err
+	}
+	return manualTonTxRef{HashHex: hashHex}, nil
+}
+
+func normalizeTonTxHashHex(raw string) (string, error) {
+	hashHex := strings.ToLower(strings.TrimSpace(strings.TrimPrefix(strings.TrimPrefix(raw, "0x"), "0X")))
+	if len(hashHex) != 64 {
+		return "", fmt.Errorf("invalid ton transaction hash length")
+	}
+	if _, err := hex.DecodeString(hashHex); err != nil {
+		return "", fmt.Errorf("invalid ton transaction hash")
+	}
+	return hashHex, nil
+}
+
+func parseUint64Strict(raw string) (uint64, error) {
+	raw = strings.TrimSpace(raw)
+	if raw == "" {
+		return 0, fmt.Errorf("empty integer")
+	}
+	var out uint64
+	for _, ch := range raw {
+		if ch < '0' || ch > '9' {
+			return 0, fmt.Errorf("invalid integer")
+		}
+		out = out*10 + uint64(ch-'0')
+	}
+	return out, nil
+}
+
+func dialManualTonClient(node mdb.RpcNode) (ton.APIClientWrapped, func(), error) {
+	ctx, cancel := context.WithTimeout(context.Background(), manualVerifyRequestTimeout)
+	defer cancel()
+	return ConnectTonLiteAPI(ctx, node.Url, manualVerifyRequestTimeout, 3)
+}
+
+func validateManualTonPaymentWithAPI(ctx context.Context, api ton.APIClientWrapped, order *mdb.Orders, receive *address.Address, ref manualTonTxRef) (string, error) {
+	master, err := api.CurrentMasterchainInfo(ctx)
+	if err != nil {
+		return "", fmt.Errorf("fetch current masterchain: %w", err)
+	}
+	txs, err := listManualTonCandidateTransactions(ctx, api, master, receive, ref)
+	if err != nil {
+		return "", fmt.Errorf("list ton account transactions: %w", err)
+	}
+	if len(txs) == 0 {
 		return "", fmt.Errorf("transaction not found")
 	}
-	if err = ensureSolanaConfirmations(order.Network, sig); err != nil {
+
+	state, err := manualTonTokenState(ctx, api, master, receive)
+	if err != nil {
 		return "", err
 	}
+	return validateManualTonPaymentCandidates(order, receive, ref, txs, state)
+}
+
+func validateManualTonPaymentCandidates(order *mdb.Orders, receive *address.Address, ref manualTonTxRef, txs []*tlb.Transaction, state *manualTonState) (string, error) {
+	if state == nil {
+		state = &manualTonState{jettonWallets: make(map[string]mdb.ChainToken)}
+	}
+	var matched []*TonObservedTransfer
+	for _, tx := range txs {
+		if tx == nil {
+			continue
+		}
+		hashHex := hex.EncodeToString(tx.Hash)
+		if !strings.EqualFold(hashHex, ref.HashHex) {
+			continue
+		}
+		if ref.HasLT && tx.LT != ref.LT {
+			continue
+		}
+		transfer, err := ParseTonInboundTransfer(tx, receive, state.nativeToken, state.jettonWallets)
+		if err != nil || transfer == nil {
+			continue
+		}
+		if err = EnsureTonTransferMatchesOrder(order, transfer); err != nil {
+			return "", err
+		}
+		matched = append(matched, transfer)
+	}
+	if len(matched) == 0 {
+		return "", fmt.Errorf("matching ton transfer to order address not found")
+	}
+	if len(matched) > 1 && !ref.HasLT {
+		return "", fmt.Errorf("ton transaction hash matched multiple recent transactions; submit canonical id or lt:hash")
+	}
+	receiveRaw := addressutil.TonRawAddressObjectKey(receive)
+	return TonCanonicalBlockTransactionID(receiveRaw, matched[0].LT, matched[0].TxHashHex), nil
+}
+
+func listManualTonCandidateTransactions(ctx context.Context, api ton.APIClientWrapped, master *ton.BlockIDExt, receive *address.Address, ref manualTonTxRef) ([]*tlb.Transaction, error) {
+	waiter := api.WaitForBlock(master.SeqNo)
+	if ref.HasLT {
+		hashBytes, err := hex.DecodeString(ref.HashHex)
+		if err != nil {
+			return nil, err
+		}
+		return waiter.ListTransactions(ctx, receive, 1, ref.LT, hashBytes)
+	}
+
+	account, err := waiter.GetAccount(ctx, master, receive)
+	if err != nil {
+		return nil, fmt.Errorf("fetch ton account state: %w", err)
+	}
+	if account == nil || account.LastTxLT == 0 || len(account.LastTxHash) == 0 {
+		return nil, fmt.Errorf("transaction not found")
+	}
+	return waiter.ListTransactions(ctx, receive, 100, account.LastTxLT, account.LastTxHash)
+}
+
+type manualTonState struct {
+	nativeToken   *mdb.ChainToken
+	jettonWallets map[string]mdb.ChainToken
+}
+
+func manualTonTokenState(ctx context.Context, api ton.APIClientWrapped, master *ton.BlockIDExt, receive *address.Address) (*manualTonState, error) {
+	tokens, err := data.ListEnabledChainTokensByNetwork(mdb.NetworkTon)
+	if err != nil {
+		return nil, err
+	}
+	state := &manualTonState{jettonWallets: make(map[string]mdb.ChainToken)}
+	for i := range tokens {
+		sym := strings.ToUpper(strings.TrimSpace(tokens[i].Symbol))
+		contract := strings.TrimSpace(tokens[i].ContractAddress)
+		if sym == TonNativeSymbol && contract == "" {
+			token := tokens[i]
+			state.nativeToken = &token
+			continue
+		}
+		if contract == "" {
+			continue
+		}
+		masterAddr, err := addressutil.ParseTonMainnetAddress(contract)
+		if err != nil {
+			continue
+		}
+		wallet, err := jetton.NewJettonMasterClient(api, masterAddr.Address).GetJettonWalletAtBlock(ctx, receive, master)
+		if err != nil {
+			continue
+		}
+		state.jettonWallets[addressutil.TonRawAddressObjectKey(wallet.Address())] = tokens[i]
+	}
+	return state, nil
+}
+
+func validateManualSolanaPayment(order *mdb.Orders, sig string) (string, error) {
+	sig = strings.TrimSpace(sig)
+	nodes, err := data.ListManualPaymentRpcCandidates(mdb.NetworkSolana, mdb.RpcNodeTypeHttp)
+	if err != nil {
+		return "", err
+	}
+	if len(nodes) == 0 {
+		return "", fmt.Errorf("no enabled %s %s RPC node configured in rpc_nodes", mdb.NetworkSolana, mdb.RpcNodeTypeHttp)
+	}
+
+	var verifyErrors []string
+	for _, node := range nodes {
+		rpcURL := strings.TrimSpace(node.Url)
+		if rpcURL == "" {
+			continue
+		}
+		if err = validateManualSolanaPaymentWithRPC(order, sig, node); err != nil {
+			verifyErrors = append(verifyErrors, fmt.Sprintf("%s: %v", manualRpcNodeLabel(node), err))
+			continue
+		}
+		return sig, nil
+	}
+	if len(verifyErrors) > 0 {
+		return "", fmt.Errorf("manual Solana verification failed: %s", strings.Join(verifyErrors, "; "))
+	}
+	return "", fmt.Errorf("no enabled %s %s RPC node configured in rpc_nodes", mdb.NetworkSolana, mdb.RpcNodeTypeHttp)
+}
+
+func validateManualSolanaPaymentWithRPC(order *mdb.Orders, sig string, node mdb.RpcNode) error {
+	rpcURL := strings.TrimSpace(node.Url)
+	txData, err := solGetTransactionWithURL(rpcURL, sig)
+	if err != nil {
+		return fmt.Errorf("fetch solana transaction: %w", err)
+	}
+	if !gjson.GetBytes(txData, "result").Exists() || gjson.GetBytes(txData, "result").Type == gjson.Null {
+		return fmt.Errorf("transaction not found")
+	}
+	if err = ensureSolanaConfirmationsWithRPC(order.Network, sig, rpcURL); err != nil {
+		return err
+	}
 
 	tokens, err := data.ListEnabledChainTokensByNetwork(mdb.NetworkSolana)
 	if err != nil {
-		return "", err
+		return err
 	}
 	mintTokens := make(map[string]*mdb.ChainToken, len(tokens))
 	var nativeSolToken *mdb.ChainToken
@@ -615,17 +956,17 @@ func validateManualSolanaPayment(order *mdb.Orders, sig string) (string, error)
 			continue
 		}
 		if err = ensureSolanaTransferNotBeforeOrder(transferInfo.BlockTime, order); err != nil {
-			return "", err
+			return err
 		}
 		if amountMatchesFloat(order.ActualAmount, amount) {
-			return sig, nil
+			return nil
 		}
 		amountMismatch = true
 	}
 	if amountMismatch {
-		return "", fmt.Errorf("transaction amount mismatch")
+		return fmt.Errorf("transaction amount mismatch")
 	}
-	return "", fmt.Errorf("matching solana transfer to order address not found")
+	return fmt.Errorf("matching solana transfer to order address not found")
 }
 
 func ensureSolanaTransferNotBeforeOrder(blockTime int64, order *mdb.Orders) error {
@@ -642,6 +983,14 @@ func ensureSolanaTransferNotBeforeOrder(blockTime int64, order *mdb.Orders) erro
 }
 
 func ensureSolanaConfirmations(network, sig string) error {
+	rpcURL, err := resolveSolanaRpcURL()
+	if err != nil {
+		return err
+	}
+	return ensureSolanaConfirmationsWithRPC(network, sig, rpcURL)
+}
+
+func ensureSolanaConfirmationsWithRPC(network, sig string, rpcURL string) error {
 	chain, err := data.GetChainByNetwork(network)
 	if err != nil {
 		return err
@@ -654,7 +1003,7 @@ func ensureSolanaConfirmations(network, sig string) error {
 		return nil
 	}
 
-	body, err := SolRetryClient("getSignatureStatuses", []interface{}{
+	body, err := solRetryClientWithURL(rpcURL, "getSignatureStatuses", []interface{}{
 		[]string{sig},
 		map[string]interface{}{"searchTransactionHistory": true},
 	})

src/model/service/manual_payment_verify_test.go

@@ -1,7 +1,9 @@
 package service
 
 import (
+	"bytes"
 	"context"
+	"encoding/hex"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -9,17 +11,40 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"strings"
+	"sync/atomic"
 	"testing"
 	"time"
 
 	"github.com/GMWalletApp/epusdt/internal/testutil"
 	"github.com/GMWalletApp/epusdt/model/dao"
 	"github.com/GMWalletApp/epusdt/model/mdb"
+	addressutil "github.com/GMWalletApp/epusdt/util/address"
 	"github.com/dromara/carbon/v2"
 	"github.com/ethereum/go-ethereum/common"
 	"github.com/ethereum/go-ethereum/core/types"
+	"github.com/xssnick/tonutils-go/address"
+	"github.com/xssnick/tonutils-go/tlb"
+	"github.com/xssnick/tonutils-go/ton"
+	"github.com/xssnick/tonutils-go/ton/jetton"
+	"github.com/xssnick/tonutils-go/tvm/cell"
+	"gorm.io/gorm/clause"
 )
 
+func upsertTestChainToken(t *testing.T, token mdb.ChainToken) {
+	t.Helper()
+	if err := dao.Mdb.Clauses(clause.OnConflict{
+		Columns: []clause.Column{{Name: "network"}, {Name: "symbol"}},
+		DoUpdates: clause.AssignmentColumns([]string{
+			"contract_address",
+			"decimals",
+			"enabled",
+			"min_amount",
+		}),
+	}).Create(&token).Error; err != nil {
+		t.Fatalf("upsert token: %v", err)
+	}
+}
+
 func TestManualVerifyEvmHashAcceptsOptional0x(t *testing.T) {
 	hash := strings.Repeat("a", 64)
 	if !isEvmHash(hash) {
@@ -88,6 +113,215 @@ func TestManualVerifyNormalizeTronTxIDAcceptsOptional0x(t *testing.T) {
 	}
 }
 
+func TestParseManualTonTxRefAcceptsCanonicalLTAndHashOnly(t *testing.T) {
+	receiveRaw := "0:ba295e33b3c4c9b5265aa4ead1166a92931ce9abea120a8c5e91044a1257f89c"
+	hash := strings.Repeat("a", 64)
+
+	ref, err := parseManualTonTxRef("ton:" + receiveRaw + ":123:" + strings.ToUpper(hash))
+	if err != nil {
+		t.Fatalf("parse canonical TON tx ref: %v", err)
+	}
+	if ref.ReceiveRaw != receiveRaw || ref.LT != 123 || ref.HashHex != hash || !ref.HasLT {
+		t.Fatalf("canonical ref = %#v", ref)
+	}
+
+	ref, err = parseManualTonTxRef("456:0X" + strings.ToUpper(hash))
+	if err != nil {
+		t.Fatalf("parse lt:hash TON tx ref: %v", err)
+	}
+	if ref.ReceiveRaw != "" || ref.LT != 456 || ref.HashHex != hash || !ref.HasLT {
+		t.Fatalf("lt:hash ref = %#v", ref)
+	}
+
+	ref, err = parseManualTonTxRef("0X" + strings.ToUpper(hash))
+	if err != nil {
+		t.Fatalf("parse hash-only TON tx ref: %v", err)
+	}
+	if ref.ReceiveRaw != "" || ref.LT != 0 || ref.HashHex != hash || ref.HasLT {
+		t.Fatalf("hash-only ref = %#v", ref)
+	}
+}
+
+type fakeManualTonAPI struct {
+	ton.APIClientWrapped
+	master          *ton.BlockIDExt
+	account         *tlb.Account
+	txs             []*tlb.Transaction
+	getAccountCalls int
+	listCalls       []manualTonListCall
+}
+
+type manualTonListCall struct {
+	limit   uint32
+	lt      uint64
+	hashHex string
+}
+
+func (f *fakeManualTonAPI) CurrentMasterchainInfo(context.Context) (*ton.BlockIDExt, error) {
+	return f.master, nil
+}
+
+func (f *fakeManualTonAPI) WaitForBlock(uint32) ton.APIClientWrapped {
+	return f
+}
+
+func (f *fakeManualTonAPI) GetAccount(context.Context, *ton.BlockIDExt, *address.Address) (*tlb.Account, error) {
+	f.getAccountCalls++
+	if f.account == nil {
+		return &tlb.Account{}, nil
+	}
+	return f.account, nil
+}
+
+func (f *fakeManualTonAPI) ListTransactions(_ context.Context, _ *address.Address, limit uint32, lt uint64, txHash []byte) ([]*tlb.Transaction, error) {
+	f.listCalls = append(f.listCalls, manualTonListCall{
+		limit:   limit,
+		lt:      lt,
+		hashHex: hex.EncodeToString(txHash),
+	})
+	return f.txs, nil
+}
+
+func TestValidateManualTonPaymentWithAPINativeTON(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+
+	if err := dao.Mdb.Model(&mdb.ChainToken{}).
+		Where("network = ? AND symbol = ?", mdb.NetworkTon, "USDT").
+		Update("enabled", false).Error; err != nil {
+		t.Fatalf("disable TON USDT token: %v", err)
+	}
+
+	receive := address.MustParseAddr("EQC6KV4zs8TJtSZapOrRFmqSkxzpq-oSCoxekQRKElf4nC1I")
+	sender := address.NewAddress(0, 0, bytes.Repeat([]byte{0x66}, 32)).Bounce(false).Testnet(false)
+	tx := tonTestInboundTx(t, sender, receive, tlb.MustFromTON("1.23"), nil)
+	order := &mdb.Orders{
+		BaseModel:      mdb.BaseModel{ID: 1, CreatedAt: *carbon.NewTime(carbon.CreateFromTimestampMilli(time.Now().Add(-time.Minute).UnixMilli()))},
+		Network:        mdb.NetworkTon,
+		Token:          "TON",
+		ActualAmount:   1.23,
+		ReceiveAddress: receive.Bounce(false).String(),
+	}
+	api := &fakeManualTonAPI{
+		master: &ton.BlockIDExt{Workchain: address.MasterchainID, Shard: -0x8000000000000000, SeqNo: 9},
+		txs:    []*tlb.Transaction{tx},
+	}
+	ref := manualTonTxRef{LT: tx.LT, HashHex: hex.EncodeToString(tx.Hash), HasLT: true}
+
+	got, err := validateManualTonPaymentWithAPI(context.Background(), api, order, receive, ref)
+	if err != nil {
+		t.Fatalf("validateManualTonPaymentWithAPI(): %v", err)
+	}
+	if api.getAccountCalls != 0 {
+		t.Fatalf("exact TON ref fetched account state %d times, want 0", api.getAccountCalls)
+	}
+	if len(api.listCalls) != 1 {
+		t.Fatalf("ListTransactions calls = %#v, want one exact lookup", api.listCalls)
+	}
+	if call := api.listCalls[0]; call.limit != 1 || call.lt != tx.LT || call.hashHex != hex.EncodeToString(tx.Hash) {
+		t.Fatalf("ListTransactions exact call = %#v, want limit=1 lt/hash from ref", call)
+	}
+	want := TonCanonicalBlockTransactionID(receive.StringRaw(), tx.LT, hex.EncodeToString(tx.Hash))
+	if got != want {
+		t.Fatalf("canonical id = %q, want %q", got, want)
+	}
+}
+
+func TestValidateManualTonPaymentCandidatesUSDTJetton(t *testing.T) {
+	receive := address.MustParseAddr("EQC6KV4zs8TJtSZapOrRFmqSkxzpq-oSCoxekQRKElf4nC1I")
+	sender := address.NewAddress(0, 0, bytes.Repeat([]byte{0x68}, 32)).Bounce(false).Testnet(false)
+	jettonWallet := address.NewAddress(0, 0, bytes.Repeat([]byte{0x69}, 32)).Bounce(false).Testnet(false)
+	body, err := tlb.ToCell(jetton.TransferNotification{
+		QueryID:        7,
+		Amount:         tlb.MustFromNano(big.NewInt(1_000_000), 6),
+		Sender:         sender,
+		ForwardPayload: cell.BeginCell().EndCell(),
+	})
+	if err != nil {
+		t.Fatalf("build jetton notification body: %v", err)
+	}
+	tx := tonTestInboundTx(t, jettonWallet, receive, tlb.FromNanoTONU(1), body)
+	order := &mdb.Orders{
+		BaseModel:      mdb.BaseModel{ID: 1, CreatedAt: *carbon.NewTime(carbon.CreateFromTimestampMilli(time.Now().Add(-time.Minute).UnixMilli()))},
+		Network:        mdb.NetworkTon,
+		Token:          "USDT",
+		ActualAmount:   1,
+		ReceiveAddress: receive.Bounce(false).String(),
+	}
+	state := &manualTonState{
+		jettonWallets: map[string]mdb.ChainToken{
+			addressutil.TonRawAddressObjectKey(jettonWallet): {
+				BaseModel: mdb.BaseModel{ID: 2},
+				Network:   mdb.NetworkTon,
+				Symbol:    "USDT",
+				Decimals:  6,
+				Enabled:   true,
+			},
+		},
+	}
+
+	got, err := validateManualTonPaymentCandidates(order, receive, manualTonTxRef{
+		LT:      tx.LT,
+		HashHex: hex.EncodeToString(tx.Hash),
+		HasLT:   true,
+	}, []*tlb.Transaction{tx}, state)
+	if err != nil {
+		t.Fatalf("validateManualTonPaymentCandidates(): %v", err)
+	}
+	want := TonCanonicalBlockTransactionID(receive.StringRaw(), tx.LT, hex.EncodeToString(tx.Hash))
+	if got != want {
+		t.Fatalf("canonical id = %q, want %q", got, want)
+	}
+}
+
+func TestValidateManualTonPaymentWithAPIRejectsAmbiguousHashOnly(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+
+	if err := dao.Mdb.Model(&mdb.ChainToken{}).
+		Where("network = ? AND symbol = ?", mdb.NetworkTon, "USDT").
+		Update("enabled", false).Error; err != nil {
+		t.Fatalf("disable TON USDT token: %v", err)
+	}
+
+	receive := address.MustParseAddr("EQC6KV4zs8TJtSZapOrRFmqSkxzpq-oSCoxekQRKElf4nC1I")
+	sender := address.NewAddress(0, 0, bytes.Repeat([]byte{0x67}, 32)).Bounce(false).Testnet(false)
+	tx1 := tonTestInboundTx(t, sender, receive, tlb.MustFromTON("1.23"), nil)
+	tx2 := tonTestInboundTx(t, sender, receive, tlb.MustFromTON("1.23"), nil)
+	tx2.LT = tx1.LT + 1
+	order := &mdb.Orders{
+		BaseModel:      mdb.BaseModel{ID: 1, CreatedAt: *carbon.NewTime(carbon.CreateFromTimestampMilli(time.Now().Add(-time.Minute).UnixMilli()))},
+		Network:        mdb.NetworkTon,
+		Token:          "TON",
+		ActualAmount:   1.23,
+		ReceiveAddress: receive.Bounce(false).String(),
+	}
+	api := &fakeManualTonAPI{
+		master: &ton.BlockIDExt{Workchain: address.MasterchainID, Shard: -0x8000000000000000, SeqNo: 9},
+		account: &tlb.Account{
+			LastTxLT:   tx2.LT,
+			LastTxHash: tx2.Hash,
+		},
+		txs: []*tlb.Transaction{tx1, tx2},
+	}
+
+	_, err := validateManualTonPaymentWithAPI(context.Background(), api, order, receive, manualTonTxRef{
+		HashHex: hex.EncodeToString(tx1.Hash),
+	})
+	if err == nil || !strings.Contains(err.Error(), "matched multiple") {
+		t.Fatalf("validate ambiguous hash-only error = %v, want multiple-match error", err)
+	}
+	if api.getAccountCalls != 1 {
+		t.Fatalf("hash-only TON ref fetched account state %d times, want 1", api.getAccountCalls)
+	}
+	if len(api.listCalls) != 1 {
+		t.Fatalf("ListTransactions calls = %#v, want one recent lookup", api.listCalls)
+	}
+	if call := api.listCalls[0]; call.limit != 100 || call.lt != tx2.LT || call.hashHex != hex.EncodeToString(tx2.Hash) {
+		t.Fatalf("ListTransactions recent call = %#v, want account last tx cursor", call)
+	}
+}
+
 func TestManualVerifyDialEvmClientsIncludesHTTPNode(t *testing.T) {
 	cleanup := testutil.SetupTestDatabases(t)
 	defer cleanup()
@@ -117,6 +351,154 @@ func TestManualVerifyDialEvmClientsIncludesHTTPNode(t *testing.T) {
 	}
 }
 
+func TestManualVerifyEvmCandidatesPreferGeneralAcrossNodeTypes(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+
+	rows := []mdb.RpcNode{
+		{Network: mdb.NetworkEthereum, Type: mdb.RpcNodeTypeHttp, Url: "http://manual.example.com", Weight: 100, Enabled: true, Purpose: mdb.RpcNodePurposeManualVerify, Status: mdb.RpcNodeStatusOk},
+		{Network: mdb.NetworkEthereum, Type: mdb.RpcNodeTypeWs, Url: "ws://general.example.com", Weight: 1, Enabled: true, Purpose: mdb.RpcNodePurposeGeneral, Status: mdb.RpcNodeStatusOk},
+	}
+	if err := dao.Mdb.Create(&rows).Error; err != nil {
+		t.Fatalf("seed rpc_nodes: %v", err)
+	}
+
+	got, err := listManualEvmRpcCandidates(mdb.NetworkEthereum)
+	if err != nil {
+		t.Fatalf("listManualEvmRpcCandidates(): %v", err)
+	}
+	urls := make([]string, 0, len(got))
+	for _, node := range got {
+		urls = append(urls, node.Url)
+	}
+	want := []string{"ws://general.example.com", "http://manual.example.com"}
+	if len(urls) != len(want) {
+		t.Fatalf("candidate urls = %#v, want %#v", urls, want)
+	}
+	for i := range want {
+		if urls[i] != want[i] {
+			t.Fatalf("candidate urls = %#v, want %#v", urls, want)
+		}
+	}
+}
+
+func TestManualRpcNodeLabelHidesSensitiveURLParts(t *testing.T) {
+	label := manualRpcNodeLabel(mdb.RpcNode{
+		BaseModel: mdb.BaseModel{ID: 9},
+		Network:   mdb.NetworkEthereum,
+		Type:      mdb.RpcNodeTypeHttp,
+		Url:       "https://rpc.example.com/v3/secret-key?token=secret",
+		Purpose:   mdb.RpcNodePurposeManualVerify,
+	})
+	if strings.Contains(label, "secret") || strings.Contains(label, "/v3/") {
+		t.Fatalf("manualRpcNodeLabel() leaked sensitive URL parts: %s", label)
+	}
+	if !strings.Contains(label, "endpoint=https://rpc.example.com") {
+		t.Fatalf("manualRpcNodeLabel() = %s, want sanitized endpoint", label)
+	}
+	if !strings.Contains(label, "purpose=manual_verify") {
+		t.Fatalf("manualRpcNodeLabel() = %s, want purpose", label)
+	}
+}
+
+func TestManualVerifyDialEvmClientDoesNotForwardUserIPHeader(t *testing.T) {
+	var headerCalls int32
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if got := r.Header.Get("X-USER-IP"); got != "" {
+			t.Errorf("X-USER-IP header = %q, want empty", got)
+			http.Error(w, "unexpected user ip header", http.StatusBadRequest)
+			return
+		}
+		atomic.AddInt32(&headerCalls, 1)
+		w.Header().Set("Content-Type", "application/json")
+		_ = json.NewEncoder(w).Encode(map[string]interface{}{
+			"jsonrpc": "2.0",
+			"id":      1,
+			"error": map[string]interface{}{
+				"code":    -32000,
+				"message": "not found",
+			},
+		})
+	}))
+	defer server.Close()
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	client, err := dialManualEvmClient(ctx, mdb.RpcNode{
+		Network: mdb.NetworkEthereum,
+		Type:    mdb.RpcNodeTypeHttp,
+		Url:     server.URL,
+		Purpose: mdb.RpcNodePurposeManualVerify,
+	})
+	if err != nil {
+		t.Fatalf("dialManualEvmClient(): %v", err)
+	}
+	defer client.Close()
+
+	_, _ = client.TransactionReceipt(ctx, common.HexToHash("0x"+strings.Repeat("a", 64)))
+	if got := atomic.LoadInt32(&headerCalls); got == 0 {
+		t.Fatal("manual verify EVM request did not reach test RPC")
+	}
+}
+
+func TestManualVerifyDialEvmClientDoesNotForwardUserIPForGeneralNode(t *testing.T) {
+	var calls int32
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if got := r.Header.Get("X-USER-IP"); got != "" {
+			t.Errorf("X-USER-IP header = %q, want empty", got)
+			http.Error(w, "unexpected user ip header", http.StatusBadRequest)
+			return
+		}
+		atomic.AddInt32(&calls, 1)
+		w.Header().Set("Content-Type", "application/json")
+		_ = json.NewEncoder(w).Encode(map[string]interface{}{
+			"jsonrpc": "2.0",
+			"id":      1,
+			"error": map[string]interface{}{
+				"code":    -32000,
+				"message": "not found",
+			},
+		})
+	}))
+	defer server.Close()
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	client, err := dialManualEvmClient(ctx, mdb.RpcNode{
+		Network: mdb.NetworkEthereum,
+		Type:    mdb.RpcNodeTypeHttp,
+		Url:     server.URL,
+		Purpose: mdb.RpcNodePurposeGeneral,
+	})
+	if err != nil {
+		t.Fatalf("dialManualEvmClient(): %v", err)
+	}
+	defer client.Close()
+
+	_, _ = client.TransactionReceipt(ctx, common.HexToHash("0x"+strings.Repeat("a", 64)))
+	if got := atomic.LoadInt32(&calls); got == 0 {
+		t.Fatal("general EVM request did not reach test RPC")
+	}
+}
+
+func TestTronPostJSONDoesNotForwardUserIPWithoutHeaders(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if got := r.Header.Get("X-USER-IP"); got != "" {
+			t.Errorf("X-USER-IP header = %q, want empty", got)
+			http.Error(w, "unexpected user ip header", http.StatusBadRequest)
+			return
+		}
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(`{"ok":true}`))
+	}))
+	defer server.Close()
+
+	var out map[string]interface{}
+	if err := tronPostJSON(server.URL, "", "/wallet/getnowblock", map[string]interface{}{}, &out); err != nil {
+		t.Fatalf("tronPostJSON(): %v", err)
+	}
+}
+
 func TestManualVerifyEvmRejectsTransactionBeforeOrder(t *testing.T) {
 	order := &mdb.Orders{BaseModel: mdb.BaseModel{CreatedAt: *carbon.NewTime(carbon.CreateFromTimestampMilli(time.Now().UnixMilli()))}}
 	txTime := uint64(time.Now().Add(-time.Hour).Unix())
@@ -220,15 +602,13 @@ func TestManualVerifyTronTRC20UsesTransferEvent(t *testing.T) {
 	if err != nil {
 		t.Fatalf("recipient address: %v", err)
 	}
-	if err = dao.Mdb.Create(&mdb.ChainToken{
+	upsertTestChainToken(t, mdb.ChainToken{
 		Network:         mdb.NetworkTron,
 		Symbol:          "USDT",
 		ContractAddress: contractAddress,
 		Decimals:        6,
 		Enabled:         true,
-	}).Error; err != nil {
+	})
-		t.Fatalf("create token: %v", err)
-	}
 
 	rawAmount := big.NewInt(1230000)
 	tx := manualTronTransactionFromCallData(t, contractHex, recipientHex, rawAmount)
@@ -271,7 +651,12 @@ func TestManualVerifyTronPaymentHTTPFlow(t *testing.T) {
 
 	rawAmount := big.NewInt(1230000)
 	blockTimeMs := time.Now().Add(time.Minute).UnixMilli()
+	requestCalls := 0
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if got := r.Header.Get("X-USER-IP"); got != "" {
+			t.Errorf("X-USER-IP header = %q, want empty", got)
+		}
+		requestCalls++
 		var req map[string]string
 		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
 			t.Errorf("decode tron request: %v", err)
@@ -333,18 +718,17 @@ func TestManualVerifyTronPaymentHTTPFlow(t *testing.T) {
 		Url:     server.URL,
 		Enabled: true,
 		Status:  mdb.RpcNodeStatusOk,
+		Purpose: mdb.RpcNodePurposeManualVerify,
 	}).Error; err != nil {
 		t.Fatalf("create tron rpc node: %v", err)
 	}
-	if err = dao.Mdb.Create(&mdb.ChainToken{
+	upsertTestChainToken(t, mdb.ChainToken{
 		Network:         mdb.NetworkTron,
 		Symbol:          "USDT",
 		ContractAddress: contractAddress,
 		Decimals:        6,
 		Enabled:         true,
-	}).Error; err != nil {
+	})
-		t.Fatalf("create token: %v", err)
-	}
 	order := &mdb.Orders{
 		TradeId:        "manual-tron-http-flow",
 		OrderId:        "manual-tron-http-flow",
@@ -366,6 +750,9 @@ func TestManualVerifyTronPaymentHTTPFlow(t *testing.T) {
 	if got != txID {
 		t.Fatalf("canonical tx id = %q, want %q", got, txID)
 	}
+	if requestCalls != 3 {
+		t.Fatalf("manual verify request calls = %d, want 3", requestCalls)
+	}
 }
 
 func TestManualVerifySolanaRejectsMissingBlockTime(t *testing.T) {

src/model/service/okpay_service.go

@@ -268,10 +268,14 @@ func HandleOkPayNotify(form map[string]string, rawFormData string) error {
 		TradeId:            order.TradeId,
 		BlockTransactionId: payload.OrderID,
 	})
+	processed := err == nil
 	if err != nil && err != constant.OrderBlockAlreadyProcess {
 		return err
 	}
 
+	if processed {
+		sendPaymentNotification(order)
+	}
 	if err = data.MarkProviderOrderPaid(payload.UniqueID, order.PayProvider, payload.RawFormData); err != nil {
 		return err
 	}

src/model/service/okpay_service_test.go

@@ -0,0 +1,193 @@
+package service
+
+import (
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/GMWalletApp/epusdt/internal/testutil"
+	"github.com/GMWalletApp/epusdt/model/dao"
+	"github.com/GMWalletApp/epusdt/model/data"
+	"github.com/GMWalletApp/epusdt/model/mdb"
+	"github.com/GMWalletApp/epusdt/notify"
+)
+
+func TestHandleOkPayNotifySendsPaymentNotificationOnSuccess(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+
+	const (
+		channelType     = "test-okpay-pay-success"
+		shopID          = "okpay-shop-notify"
+		shopToken       = "okpay-shop-token"
+		tradeID         = "okpay-notify-success-001"
+		orderID         = "merchant-okpay-notify-success-001"
+		providerOrderID = "okpay-provider-success-001"
+		rawFormData     = "raw-okpay-form"
+	)
+
+	got := make(chan string, 1)
+	notify.RegisterSender(channelType, func(config, text string) error {
+		got <- text
+		return nil
+	})
+
+	if err := dao.Mdb.Create(&mdb.NotificationChannel{
+		Type:    channelType,
+		Name:    "test okpay pay success",
+		Config:  "{}",
+		Events:  `{"pay_success":true}`,
+		Enabled: true,
+	}).Error; err != nil {
+		t.Fatalf("seed notification channel: %v", err)
+	}
+	if err := data.SetSetting(mdb.SettingGroupOkPay, mdb.SettingKeyOkPayShopID, shopID, mdb.SettingTypeString); err != nil {
+		t.Fatalf("seed okpay shop id: %v", err)
+	}
+	if err := data.SetSetting(mdb.SettingGroupOkPay, mdb.SettingKeyOkPayShopToken, shopToken, mdb.SettingTypeString); err != nil {
+		t.Fatalf("seed okpay shop token: %v", err)
+	}
+
+	order := &mdb.Orders{
+		TradeId:        tradeID,
+		OrderId:        orderID,
+		Amount:         1,
+		Currency:       "CNY",
+		ActualAmount:   0.15,
+		ReceiveAddress: "OKPAY",
+		Token:          "USDT",
+		Network:        mdb.NetworkTron,
+		Status:         mdb.StatusWaitPay,
+		PaymentType:    mdb.PaymentTypeEpay,
+		PayProvider:    mdb.PaymentProviderOkPay,
+	}
+	if err := dao.Mdb.Create(order).Error; err != nil {
+		t.Fatalf("seed order: %v", err)
+	}
+	if err := dao.Mdb.Create(&mdb.ProviderOrder{
+		TradeId:         tradeID,
+		Provider:        mdb.PaymentProviderOkPay,
+		ProviderOrderID: providerOrderID,
+		Amount:          0.15,
+		Coin:            "USDT",
+		Status:          mdb.ProviderOrderStatusPending,
+	}).Error; err != nil {
+		t.Fatalf("seed provider order: %v", err)
+	}
+
+	form := okPayNotifyTestForm(shopID, shopToken, providerOrderID, tradeID, "0.15000000", "USDT")
+	if err := HandleOkPayNotify(form, rawFormData); err != nil {
+		t.Fatalf("handle okpay notify: %v", err)
+	}
+
+	select {
+	case text := <-got:
+		if !strings.Contains(text, tradeID) {
+			t.Fatalf("notification text = %q, want trade id %s", text, tradeID)
+		}
+		if !strings.Contains(text, orderID) {
+			t.Fatalf("notification text = %q, want order id %s", text, orderID)
+		}
+	case <-time.After(2 * time.Second):
+		t.Fatal("timed out waiting for payment notification")
+	}
+
+	if err := HandleOkPayNotify(form, rawFormData); err != nil {
+		t.Fatalf("handle duplicate okpay notify: %v", err)
+	}
+	select {
+	case text := <-got:
+		t.Fatalf("duplicate notification sent: %q", text)
+	case <-time.After(200 * time.Millisecond):
+	}
+}
+
+func TestHandleOkPayNotifySettlesPlaceholderParent(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+
+	const (
+		shopID          = "okpay-shop-placeholder"
+		shopToken       = "okpay-shop-placeholder-token"
+		parentTradeID   = "okpay-placeholder-parent-001"
+		providerOrderID = "okpay-placeholder-provider-001"
+	)
+
+	if err := data.SetSetting(mdb.SettingGroupOkPay, mdb.SettingKeyOkPayShopID, shopID, mdb.SettingTypeString); err != nil {
+		t.Fatalf("seed okpay shop id: %v", err)
+	}
+	if err := data.SetSetting(mdb.SettingGroupOkPay, mdb.SettingKeyOkPayShopToken, shopToken, mdb.SettingTypeString); err != nil {
+		t.Fatalf("seed okpay shop token: %v", err)
+	}
+
+	parent := &mdb.Orders{
+		TradeId:        parentTradeID,
+		OrderId:        "merchant-okpay-placeholder-parent-001",
+		Amount:         1,
+		Currency:       "CNY",
+		ActualAmount:   0.15,
+		ReceiveAddress: "OKPAY",
+		Token:          "USDT",
+		Network:        mdb.PaymentProviderOkPay,
+		Status:         mdb.StatusWaitPay,
+		IsSelected:     true,
+		PaymentType:    mdb.PaymentTypeGmpay,
+		PayProvider:    mdb.PaymentProviderOkPay,
+	}
+	if err := dao.Mdb.Create(parent).Error; err != nil {
+		t.Fatalf("seed parent order: %v", err)
+	}
+	if err := dao.Mdb.Create(&mdb.ProviderOrder{
+		TradeId:         parentTradeID,
+		Provider:        mdb.PaymentProviderOkPay,
+		ProviderOrderID: providerOrderID,
+		Amount:          0.15,
+		Coin:            "USDT",
+		Status:          mdb.ProviderOrderStatusPending,
+	}).Error; err != nil {
+		t.Fatalf("seed provider order: %v", err)
+	}
+
+	form := okPayNotifyTestForm(shopID, shopToken, providerOrderID, parentTradeID, "0.15000000", "USDT")
+	if err := HandleOkPayNotify(form, "placeholder-okpay-form"); err != nil {
+		t.Fatalf("handle okpay notify: %v", err)
+	}
+
+	reloadedParent, err := data.GetOrderInfoByTradeId(parentTradeID)
+	if err != nil {
+		t.Fatalf("reload parent: %v", err)
+	}
+	if reloadedParent.Status != mdb.StatusPaySuccess {
+		t.Fatalf("parent status = %d, want %d", reloadedParent.Status, mdb.StatusPaySuccess)
+	}
+	if reloadedParent.PayBySubId != 0 {
+		t.Fatalf("parent pay_by_sub_id = %d, want 0", reloadedParent.PayBySubId)
+	}
+	if reloadedParent.Token != "USDT" || reloadedParent.Network != mdb.PaymentProviderOkPay || reloadedParent.ReceiveAddress != "OKPAY" || reloadedParent.ActualAmount != 0.15 {
+		t.Fatalf("okpay parent fields changed: token=%q network=%q address=%q actual=%v", reloadedParent.Token, reloadedParent.Network, reloadedParent.ReceiveAddress, reloadedParent.ActualAmount)
+	}
+	providerRow, err := data.GetProviderOrderByTradeIDAndProvider(parentTradeID, mdb.PaymentProviderOkPay)
+	if err != nil {
+		t.Fatalf("reload provider row: %v", err)
+	}
+	if providerRow.Status != mdb.ProviderOrderStatusPaid {
+		t.Fatalf("provider status = %q, want %q", providerRow.Status, mdb.ProviderOrderStatusPaid)
+	}
+}
+
+func okPayNotifyTestForm(shopID, shopToken, providerOrderID, tradeID, amount, coin string) map[string]string {
+	form := map[string]string{
+		"code":              "200",
+		"id":                shopID,
+		"status":            "success",
+		"data[order_id]":    providerOrderID,
+		"data[unique_id]":   tradeID,
+		"data[pay_user_id]": "123456789",
+		"data[amount]":      amount,
+		"data[coin]":        coin,
+		"data[status]":      "1",
+		"data[type]":        "deposit",
+	}
+	form["sign"] = okPayNotifySign(form, shopToken)
+	return form
+}

src/model/service/order_service.go

@@ -1,12 +1,12 @@
 package service
 
 import (
+	cryptorand "crypto/rand"
+	"encoding/base64"
 	"errors"
 	"fmt"
-	"math/rand"
 	"strings"
 	"sync"
-	"time"
 
 	"github.com/GMWalletApp/epusdt/config"
 	"github.com/GMWalletApp/epusdt/model/dao"
@@ -14,9 +14,11 @@ import (
 	"github.com/GMWalletApp/epusdt/model/mdb"
 	"github.com/GMWalletApp/epusdt/model/request"
 	"github.com/GMWalletApp/epusdt/model/response"
+	addressutil "github.com/GMWalletApp/epusdt/util/address"
 	"github.com/GMWalletApp/epusdt/util/constant"
 	"github.com/GMWalletApp/epusdt/util/log"
 	"github.com/GMWalletApp/epusdt/util/math"
+	"github.com/GMWalletApp/epusdt/util/security"
 	"github.com/dromara/carbon/v2"
 	"github.com/shopspring/decimal"
 )
@@ -47,35 +49,71 @@ func normalizeOrderAddressByNetwork(network, address string) string {
 	switch network {
 	case mdb.NetworkEthereum, mdb.NetworkBsc, mdb.NetworkPolygon, mdb.NetworkPlasma:
 		return strings.ToLower(address)
+	case mdb.NetworkTon:
+		if normalized, err := addressutil.NormalizeTonAddress(address); err == nil {
+			return normalized
+		}
+		return address
 	default:
 		return address
 	}
 }
 
+func ensureEnabledOrderAsset(network, token string) (*mdb.ChainToken, error) {
+	tokenRow, err := data.GetEnabledChainTokenBySymbol(network, token)
+	if err != nil {
+		return nil, err
+	}
+	if tokenRow == nil || tokenRow.ID == 0 {
+		return nil, constant.SupportedAssetNotFound
+	}
+	return tokenRow, nil
+}
+
+func validateCreateTransactionTokenNetwork(token, network string) error {
+	if (token == "") != (network == "") {
+		return constant.ParamsMarshalErr
+	}
+	return nil
+}
+
+func buildCreateTransactionResponse(order *mdb.Orders) *response.CreateTransactionResponse {
+	return &response.CreateTransactionResponse{
+		TradeId:        order.TradeId,
+		OrderId:        order.OrderId,
+		Amount:         order.Amount,
+		Currency:       order.Currency,
+		ActualAmount:   order.ActualAmount,
+		ReceiveAddress: order.ReceiveAddress,
+		Token:          order.Token,
+		Status:         order.Status,
+		ExpirationTime: carbon.Now().AddMinutes(config.GetOrderExpirationTime()).Timestamp(),
+		PaymentUrl:     fmt.Sprintf("%s/pay/checkout-counter/%s", config.GetAppUri(), order.TradeId),
+	}
+}
+
 // CreateTransaction creates a new payment order.
 func CreateTransaction(req *request.CreateTransactionRequest, apiKey *mdb.ApiKey) (*response.CreateTransactionResponse, error) {
-	gCreateTransactionLock.Lock()
-	defer gCreateTransactionLock.Unlock()
-
 	token := strings.ToUpper(strings.TrimSpace(req.Token))
 	currency := strings.ToUpper(strings.TrimSpace(req.Currency))
 	network := strings.ToLower(strings.TrimSpace(req.Network))
+	if err := validateCreateTransactionTokenNetwork(token, network); err != nil {
+		return nil, err
+	}
+	notifyURL := strings.TrimSpace(req.NotifyUrl)
+	if err := security.ValidatePublicHTTPURL(notifyURL); err != nil {
+		return nil, constant.NotifyURLErr
+	}
+	paymentType := mdb.PaymentTypeGmpay
+	if strings.EqualFold(req.PaymentType, mdb.PaymentTypeEpay) {
+		paymentType = mdb.PaymentTypeEpay
+	}
+
+	gCreateTransactionLock.Lock()
+	defer gCreateTransactionLock.Unlock()
+
 	amountPrecision := data.GetAmountPrecision()
 	payAmount := math.MustParsePrecFloat64(req.Amount, amountPrecision)
-	rate := config.GetRateForCoin(strings.ToLower(token), strings.ToLower(currency))
-	if rate <= 0 {
-		return nil, constant.RateAmountErr
-	}
-
-	decimalPayAmount := decimal.NewFromFloat(payAmount)
-	decimalTokenAmount := decimalPayAmount.Mul(decimal.NewFromFloat(rate))
-	if decimalPayAmount.Cmp(decimal.NewFromFloat(CnyMinimumPaymentAmount)) == -1 {
-		return nil, constant.PayAmountErr
-	}
-	if decimalTokenAmount.Cmp(decimal.NewFromFloat(UsdtMinimumPaymentAmount)) == -1 {
-		return nil, constant.PayAmountErr
-	}
-
 	exist, err := data.GetOrderInfoByOrderId(req.OrderId)
 	if err != nil {
 		return nil, err
@@ -84,9 +122,49 @@ func CreateTransaction(req *request.CreateTransactionRequest, apiKey *mdb.ApiKey
 		return nil, constant.OrderAlreadyExists
 	}
 
+	decimalPayAmount := decimal.NewFromFloat(payAmount)
+	if decimalPayAmount.Cmp(decimal.NewFromFloat(CnyMinimumPaymentAmount)) == -1 {
+		return nil, constant.PayAmountErr
+	}
+
+	if token == "" && network == "" {
+		tradeID := GenerateCode()
+		order := &mdb.Orders{
+			TradeId:     tradeID,
+			OrderId:     req.OrderId,
+			Amount:      payAmount,
+			Currency:    currency,
+			Status:      mdb.StatusWaitSelect,
+			NotifyUrl:   notifyURL,
+			RedirectUrl: req.RedirectUrl,
+			Name:        req.Name,
+			PaymentType: paymentType,
+			PayProvider: mdb.PaymentProviderOnChain,
+			ApiKeyID:    apiKeyID(apiKey),
+		}
+		if err = data.CreateOrderWithTransaction(dao.Mdb, order); err != nil {
+			return nil, err
+		}
+		return buildCreateTransactionResponse(order), nil
+	}
+
 	if !data.IsChainEnabled(network) {
 		return nil, constant.ChainNotEnabled
 	}
+	if _, err = ensureEnabledOrderAsset(network, token); err != nil {
+		return nil, err
+	}
+
+	rate := config.GetRateForCoin(strings.ToLower(token), strings.ToLower(currency))
+	if rate <= 0 {
+		return nil, constant.RateAmountErr
+	}
+
+	decimalTokenAmount := decimalPayAmount.Mul(decimal.NewFromFloat(rate))
+	if decimalTokenAmount.Cmp(decimal.NewFromFloat(UsdtMinimumPaymentAmount)) == -1 {
+		return nil, constant.PayAmountErr
+	}
+
 	walletAddress, err := data.GetAvailableWalletAddressByNetwork(network)
 	if err != nil {
 		return nil, err
@@ -116,10 +194,10 @@ func CreateTransaction(req *request.CreateTransactionRequest, apiKey *mdb.ApiKey
 		Token:          token,
 		Network:        network,
 		Status:         mdb.StatusWaitPay,
-		NotifyUrl:      req.NotifyUrl,
+		NotifyUrl:      notifyURL,
 		RedirectUrl:    req.RedirectUrl,
 		Name:           req.Name,
-		PaymentType:    req.PaymentType,
+		PaymentType:    paymentType,
 		PayProvider:    mdb.PaymentProviderOnChain,
 		ApiKeyID:       apiKeyID(apiKey),
 	}
@@ -134,19 +212,7 @@ func CreateTransaction(req *request.CreateTransactionRequest, apiKey *mdb.ApiKey
 		return nil, err
 	}
 
-	expirationTime := carbon.Now().AddMinutes(config.GetOrderExpirationTime()).Timestamp()
+	return buildCreateTransactionResponse(order), nil
-	resp := &response.CreateTransactionResponse{
-		TradeId:        order.TradeId,
-		OrderId:        order.OrderId,
-		Amount:         order.Amount,
-		Currency:       order.Currency,
-		ActualAmount:   order.ActualAmount,
-		ReceiveAddress: order.ReceiveAddress,
-		Token:          order.Token,
-		ExpirationTime: expirationTime,
-		PaymentUrl:     fmt.Sprintf("%s/pay/checkout-counter/%s", config.GetAppUri(), order.TradeId),
-	}
-	return resp, nil
 }
 
 // OrderProcessing marks an order as paid and releases its sqlite reservation.
@@ -179,15 +245,21 @@ func OrderProcessing(req *request.OrderProcessingRequest) error {
 		return err
 	}
 
-	if err = data.UnLockTransaction(req.Network, req.ReceiveAddress, req.Token, req.Amount); err != nil {
-		log.Sugar.Warnf("[order] unlock transaction after pay success failed, trade_id=%s, err=%v", req.TradeId, err)
-	}
-
 	// Load order to check parent-child relationship
 	order, err := data.GetOrderInfoByTradeId(req.TradeId)
 	if err != nil {
+		if strings.TrimSpace(req.Network) != "" && strings.TrimSpace(req.ReceiveAddress) != "" && strings.TrimSpace(req.Token) != "" && req.Amount > 0 {
+			if unlockErr := data.UnLockTransaction(req.Network, req.ReceiveAddress, req.Token, req.Amount); unlockErr != nil {
+				log.Sugar.Warnf("[order] fallback unlock transaction after pay success failed, trade_id=%s, err=%v", req.TradeId, unlockErr)
+			}
+		}
 		return fmt.Errorf("load paid order failed, trade_id=%s: %w", req.TradeId, err)
 	}
+	if hasTransactionLock(order) {
+		if err = data.UnLockTransaction(order.Network, order.ReceiveAddress, order.Token, order.ActualAmount); err != nil {
+			log.Sugar.Warnf("[order] unlock transaction after pay success failed, trade_id=%s, err=%v", order.TradeId, err)
+		}
+	}
 
 	// Parent order paid directly: expire all sub-orders and release their locks
 	if order.ParentTradeId == "" {
@@ -205,10 +277,12 @@ func OrderProcessing(req *request.OrderProcessingRequest) error {
 					log.Sugar.Warnf("[order] expire provider order failed, trade_id=%s, provider=%s, err=%v", sub.TradeId, sub.PayProvider, err)
 				}
 			}
+			if hasTransactionLock(&sub) {
 				if err = data.UnLockTransaction(sub.Network, sub.ReceiveAddress, sub.Token, sub.ActualAmount); err != nil {
 					log.Sugar.Warnf("[order] unlock sub-order transaction failed, trade_id=%s, err=%v", sub.TradeId, err)
 				}
 			}
+		}
 		return nil
 	}
 
@@ -257,9 +331,11 @@ func OrderProcessing(req *request.OrderProcessingRequest) error {
 	}
 
 	// Release parent's own wallet lock
+	if hasTransactionLock(parent) {
 		if err = data.UnLockTransaction(parent.Network, parent.ReceiveAddress, parent.Token, parent.ActualAmount); err != nil {
 			log.Sugar.Warnf("[order] unlock parent transaction failed, parent_trade_id=%s, err=%v", parent.TradeId, err)
 		}
+	}
 
 	// Release sibling locks after their status transitions commit.
 	for _, sib := range siblings {
@@ -268,10 +344,12 @@ func OrderProcessing(req *request.OrderProcessingRequest) error {
 				log.Sugar.Warnf("[order] expire sibling provider order failed, trade_id=%s, provider=%s, err=%v", sib.TradeId, sib.PayProvider, err)
 			}
 		}
+		if hasTransactionLock(&sib) {
 			if err = data.UnLockTransaction(sib.Network, sib.ReceiveAddress, sib.Token, sib.ActualAmount); err != nil {
 				log.Sugar.Warnf("[order] unlock sibling transaction failed, trade_id=%s, err=%v", sib.TradeId, err)
 			}
 		}
+	}
 
 	return nil
 }
@@ -316,9 +394,11 @@ func ReserveAvailableWalletAndAmount(tradeID string, network string, token strin
 
 // GenerateCode creates a unique trade id.
 func GenerateCode() string {
-	date := time.Now().Format("20060102")
+	buf := make([]byte, 18)
-	r := rand.Intn(1000)
+	if _, err := cryptorand.Read(buf); err != nil {
-	return fmt.Sprintf("%s%d%03d", date, time.Now().UnixNano()/1e6, r)
+		panic(fmt.Sprintf("generate trade id: crypto/rand failed: %v", err))
+	}
+	return base64.RawURLEncoding.EncodeToString(buf)
 }
 
 // GetOrderInfoByTradeId returns a validated order.
@@ -333,9 +413,106 @@ func GetOrderInfoByTradeId(tradeId string) (*mdb.Orders, error) {
 	return order, nil
 }
 
-const MaxSubOrders = 2
+// SubmitManualPayment verifies a submitted transaction hash and marks the
+// matching on-chain order paid using the same path as automatic chain scans.
+func SubmitManualPayment(tradeId, blockTransactionId string) (*response.ManualPaymentResponse, error) {
+	tradeId = strings.TrimSpace(tradeId)
+	blockTransactionId = strings.TrimSpace(blockTransactionId)
 
-// SwitchNetwork creates or returns an existing sub-order for a different token+network.
+	order, err := GetOrderInfoByTradeId(tradeId)
+	if err != nil {
+		return nil, err
+	}
+	return submitManualPaymentForOrder(order, blockTransactionId)
+}
+
+// SubmitCashierManualPayment is the public cashier variant. It rejects hashes
+// already stored on any order before touching RPC so repeated/public probes do
+// not spend RPC quota. Admin mark-paid intentionally keeps using
+// SubmitManualPayment and the existing verification path.
+func SubmitCashierManualPayment(tradeId, blockTransactionId string) (*response.ManualPaymentResponse, error) {
+	tradeId = strings.TrimSpace(tradeId)
+	blockTransactionId = strings.TrimSpace(blockTransactionId)
+
+	order, err := GetOrderInfoByTradeId(tradeId)
+	if err != nil {
+		return nil, err
+	}
+	if err = validateManualPaymentOrder(order); err != nil {
+		return nil, err
+	}
+	if err = ensureManualBlockTransactionUnused(order, blockTransactionId); err != nil {
+		return nil, err
+	}
+	return submitManualPaymentForOrder(order, blockTransactionId)
+}
+
+func submitManualPaymentForOrder(order *mdb.Orders, blockTransactionId string) (*response.ManualPaymentResponse, error) {
+	blockTransactionId = strings.TrimSpace(blockTransactionId)
+	if err := validateManualPaymentOrder(order); err != nil {
+		return nil, err
+	}
+
+	verifiedBlockTransactionID, err := ValidateManualOrderPayment(order, blockTransactionId)
+	if err != nil {
+		var rspErr *constant.RspError
+		if errors.As(err, &rspErr) {
+			return nil, err
+		}
+		return nil, constant.ManualPaymentVerifyErr
+	}
+	if err = OrderProcessing(&request.OrderProcessingRequest{
+		ReceiveAddress:     order.ReceiveAddress,
+		Currency:           order.Currency,
+		Token:              order.Token,
+		Network:            order.Network,
+		Amount:             order.ActualAmount,
+		TradeId:            order.TradeId,
+		BlockTransactionId: verifiedBlockTransactionID,
+	}); err != nil {
+		return nil, err
+	}
+
+	updatedOrder, err := GetOrderInfoByTradeId(order.TradeId)
+	if err != nil {
+		return nil, err
+	}
+	return &response.ManualPaymentResponse{
+		TradeId:            updatedOrder.TradeId,
+		Status:             updatedOrder.Status,
+		BlockTransactionId: updatedOrder.BlockTransactionId,
+	}, nil
+}
+
+func validateManualPaymentOrder(order *mdb.Orders) error {
+	if order.Status != mdb.StatusWaitPay {
+		return constant.OrderNotWaitPay
+	}
+	if !isOnChainOrder(order.PayProvider) {
+		return constant.ManualPaymentProviderErr
+	}
+	return nil
+}
+
+func isOnChainOrder(payProvider string) bool {
+	payProvider = strings.TrimSpace(payProvider)
+	return payProvider == "" || payProvider == mdb.PaymentProviderOnChain
+}
+
+func hasTransactionLock(order *mdb.Orders) bool {
+	return order != nil &&
+		isOnChainOrder(order.PayProvider) &&
+		strings.TrimSpace(order.Network) != "" &&
+		strings.TrimSpace(order.ReceiveAddress) != "" &&
+		strings.TrimSpace(order.Token) != "" &&
+		order.ActualAmount > 0
+}
+
+const MaxSubOrders = 1
+
+// SwitchNetwork completes a status=4 placeholder in place, or creates/returns
+// an existing sub-order for a different payment target once the parent is
+// already concrete.
 func SwitchNetwork(req *request.SwitchNetworkRequest) (*response.CheckoutCounterResponse, error) {
 	gCreateTransactionLock.Lock()
 	defer gCreateTransactionLock.Unlock()
@@ -354,7 +531,7 @@ func SwitchNetwork(req *request.SwitchNetworkRequest) (*response.CheckoutCounter
 	if parent.ParentTradeId != "" {
 		return nil, constant.CannotSwitchSubOrder
 	}
-	if parent.Status != mdb.StatusWaitPay {
+	if parent.Status != mdb.StatusWaitPay && parent.Status != mdb.StatusWaitSelect {
 		return nil, constant.OrderNotWaitPay
 	}
 
@@ -362,6 +539,10 @@ func SwitchNetwork(req *request.SwitchNetworkRequest) (*response.CheckoutCounter
 		return switchToOkPay(parent, token)
 	}
 
+	if parent.Status == mdb.StatusWaitSelect {
+		return completeWaitSelectOrder(parent, token, network)
+	}
+
 	// 2. Same token+network as parent → mark selected and return
 	if strings.EqualFold(parent.Token, token) && strings.EqualFold(parent.Network, network) {
 		_ = data.MarkOrderSelected(parent.TradeId)
@@ -382,8 +563,9 @@ func SwitchNetwork(req *request.SwitchNetworkRequest) (*response.CheckoutCounter
 		return buildCheckoutResponse(existing), nil
 	}
 
-	// 4. Check sub-order limit
+	// 4. Only one sub-order may ever be created under a parent. Existing
-	count, err := data.CountActiveSubOrders(parent.TradeId)
+	// active sub-orders are reused above; any other target after that is blocked.
+	count, err := data.CountSubOrders(parent.TradeId)
 	if err != nil {
 		return nil, err
 	}
@@ -391,7 +573,16 @@ func SwitchNetwork(req *request.SwitchNetworkRequest) (*response.CheckoutCounter
 		return nil, constant.SubOrderLimitExceeded
 	}
 
-	// 5. Calculate amount for the new network
+	// 5. Validate the target chain and asset before any rate lookup so
+	// disabled/unknown tokens return the stable unsupported-asset error.
+	if !data.IsChainEnabled(network) {
+		return nil, constant.ChainNotEnabled
+	}
+	if _, err = ensureEnabledOrderAsset(network, token); err != nil {
+		return nil, err
+	}
+
+	// 6. Calculate amount for the new network
 	rate := config.GetRateForCoin(strings.ToLower(token), strings.ToLower(parent.Currency))
 	if rate <= 0 {
 		return nil, constant.RateAmountErr
@@ -402,10 +593,7 @@ func SwitchNetwork(req *request.SwitchNetworkRequest) (*response.CheckoutCounter
 		return nil, constant.PayAmountErr
 	}
 
-	// 6. Find and lock wallet
+	// 7. Find and lock wallet
-	if !data.IsChainEnabled(network) {
-		return nil, constant.ChainNotEnabled
-	}
 	walletAddress, err := data.GetAvailableWalletAddressByNetwork(network)
 	if err != nil {
 		return nil, err
@@ -424,7 +612,7 @@ func SwitchNetwork(req *request.SwitchNetworkRequest) (*response.CheckoutCounter
 		return nil, constant.NotAvailableAmountErr
 	}
 
-	// 7. Create sub-order
+	// 8. Create sub-order
 	tx := dao.Mdb.Begin()
 	subOrder := &mdb.Orders{
 		TradeId:         subTradeID,
@@ -464,7 +652,63 @@ func SwitchNetwork(req *request.SwitchNetworkRequest) (*response.CheckoutCounter
 	return buildCheckoutResponse(subOrder), nil
 }
 
+func completeWaitSelectOrder(parent *mdb.Orders, token string, network string) (*response.CheckoutCounterResponse, error) {
+	if !data.IsChainEnabled(network) {
+		return nil, constant.ChainNotEnabled
+	}
+	if _, err := ensureEnabledOrderAsset(network, token); err != nil {
+		return nil, err
+	}
+
+	rate := config.GetRateForCoin(strings.ToLower(token), strings.ToLower(parent.Currency))
+	if rate <= 0 {
+		return nil, constant.RateAmountErr
+	}
+	decimalPayAmount := decimal.NewFromFloat(parent.Amount)
+	decimalTokenAmount := decimalPayAmount.Mul(decimal.NewFromFloat(rate))
+	if decimalTokenAmount.Cmp(decimal.NewFromFloat(UsdtMinimumPaymentAmount)) == -1 {
+		return nil, constant.PayAmountErr
+	}
+
+	walletAddress, err := data.GetAvailableWalletAddressByNetwork(network)
+	if err != nil {
+		return nil, err
+	}
+	if len(walletAddress) <= 0 {
+		return nil, constant.NotAvailableWalletAddress
+	}
+
+	amount := math.MustParsePrecFloat64(decimalTokenAmount.InexactFloat64(), data.GetAmountPrecision())
+	availableAddress, availableAmount, err := ReserveAvailableWalletAndAmount(parent.TradeId, network, token, amount, walletAddress)
+	if err != nil {
+		return nil, err
+	}
+	if availableAddress == "" {
+		return nil, constant.NotAvailableAmountErr
+	}
+
+	updated, err := data.CompleteWaitSelectOrder(parent.TradeId, network, token, availableAddress, availableAmount)
+	if err != nil {
+		_ = data.UnLockTransactionByTradeId(parent.TradeId)
+		return nil, err
+	}
+	if !updated {
+		_ = data.UnLockTransactionByTradeId(parent.TradeId)
+		return nil, constant.OrderStatusConflict
+	}
+
+	order, err := data.GetOrderInfoByTradeId(parent.TradeId)
+	if err != nil {
+		return nil, err
+	}
+	return buildCheckoutResponse(order), nil
+}
+
 func buildCheckoutResponse(order *mdb.Orders) *response.CheckoutCounterResponse {
+	paymentType := mdb.PaymentTypeGmpay
+	if isEPayOrder(order) {
+		paymentType = mdb.PaymentTypeEpay
+	}
 	return &response.CheckoutCounterResponse{
 		TradeId:        order.TradeId,
 		Amount:         order.Amount,
@@ -473,14 +717,93 @@ func buildCheckoutResponse(order *mdb.Orders) *response.CheckoutCounterResponse
 		Currency:       order.Currency,
 		ReceiveAddress: order.ReceiveAddress,
 		Network:        order.Network,
+		Status:         order.Status,
+		PaymentType:    strings.ToLower(paymentType),
 		ExpirationTime: order.CreatedAt.AddMinutes(config.GetOrderExpirationTime()).TimestampMilli(),
-		RedirectUrl:    order.RedirectUrl,
+		RedirectUrl:    buildPublicRedirectURL(order),
-		PaymentUrl:     fmt.Sprintf("%s/pay/checkout-counter/%s", config.GetAppUri(), order.TradeId),
 		CreatedAt:      order.CreatedAt.TimestampMilli(),
 		IsSelected:     order.IsSelected,
 	}
 }
 
+func completeWaitSelectOkPayOrder(parent *mdb.Orders, token string) (*response.CheckoutCounterResponse, error) {
+	rate := config.GetRateForCoin(strings.ToLower(token), strings.ToLower(parent.Currency))
+	if rate <= 0 {
+		return nil, constant.RateAmountErr
+	}
+	decimalPayAmount := decimal.NewFromFloat(parent.Amount)
+	decimalTokenAmount := decimalPayAmount.Mul(decimal.NewFromFloat(rate))
+	if decimalTokenAmount.Cmp(decimal.NewFromFloat(UsdtMinimumPaymentAmount)) == -1 {
+		return nil, constant.PayAmountErr
+	}
+
+	amount := math.MustParsePrecFloat64(decimalTokenAmount.InexactFloat64(), data.GetAmountPrecision())
+	returnURL := strings.TrimSpace(parent.RedirectUrl)
+	if returnURL == "" {
+		returnURL = data.GetOkPayReturnURL()
+	}
+	if returnURL == "" {
+		returnURL = fmt.Sprintf("%s/pay/checkout-counter/%s", config.GetAppUri(), parent.TradeId)
+	}
+
+	tx := dao.Mdb.Begin()
+	providerRow := &mdb.ProviderOrder{
+		TradeId:         parent.TradeId,
+		Provider:        mdb.PaymentProviderOkPay,
+		ProviderOrderID: "",
+		PayURL:          "",
+		Amount:          amount,
+		Coin:            token,
+		Status:          mdb.ProviderOrderStatusCreating,
+		NotifyRaw:       "",
+	}
+	if err := data.UpsertProviderOrderCreatingWithTransaction(tx, providerRow); err != nil {
+		tx.Rollback()
+		return nil, err
+	}
+	if err := tx.Commit().Error; err != nil {
+		tx.Rollback()
+		return nil, err
+	}
+
+	okpayOrder, err := createOkPayDepositOrder(parent.TradeId, amount, token, returnURL)
+	if err != nil {
+		_ = data.MarkProviderOrderFailed(parent.TradeId, mdb.PaymentProviderOkPay)
+		return nil, constant.PaymentProviderCreateErr
+	}
+
+	finalizeTx := dao.Mdb.Begin()
+	if err = data.UpdateProviderOrderCreatedWithTransaction(finalizeTx, parent.TradeId, mdb.PaymentProviderOkPay, okpayOrder.ProviderOrderID, okpayOrder.PayURL); err != nil {
+		finalizeTx.Rollback()
+		_ = data.MarkProviderOrderFailed(parent.TradeId, mdb.PaymentProviderOkPay)
+		return nil, err
+	}
+	updated, err := data.CompleteWaitSelectOkPayOrderWithTransaction(finalizeTx, parent.TradeId, token, amount)
+	if err != nil {
+		finalizeTx.Rollback()
+		_ = data.MarkProviderOrderFailed(parent.TradeId, mdb.PaymentProviderOkPay)
+		return nil, err
+	}
+	if !updated {
+		finalizeTx.Rollback()
+		_ = data.MarkProviderOrderFailed(parent.TradeId, mdb.PaymentProviderOkPay)
+		return nil, constant.OrderStatusConflict
+	}
+	if err = finalizeTx.Commit().Error; err != nil {
+		finalizeTx.Rollback()
+		_ = data.MarkProviderOrderFailed(parent.TradeId, mdb.PaymentProviderOkPay)
+		return nil, err
+	}
+
+	order, err := data.GetOrderInfoByTradeId(parent.TradeId)
+	if err != nil {
+		return nil, err
+	}
+	resp := buildCheckoutResponse(order)
+	resp.PaymentUrl = okpayOrder.PayURL
+	return resp, nil
+}
+
 func switchToOkPay(parent *mdb.Orders, token string) (*response.CheckoutCounterResponse, error) {
 	if !data.GetOkPayEnabled() {
 		return nil, constant.PaymentProviderNotEnabled
@@ -492,6 +815,29 @@ func switchToOkPay(parent *mdb.Orders, token string) (*response.CheckoutCounterR
 		return nil, constant.PaymentProviderNotSupport
 	}
 
+	if parent.Status == mdb.StatusWaitSelect {
+		return completeWaitSelectOkPayOrder(parent, token)
+	}
+
+	if parent.PayProvider == mdb.PaymentProviderOkPay && strings.EqualFold(parent.Token, token) {
+		providerRow, err := data.GetProviderOrderByTradeIDAndProvider(parent.TradeId, mdb.PaymentProviderOkPay)
+		if err != nil {
+			return nil, err
+		}
+		if providerRow.ID == 0 || strings.TrimSpace(providerRow.PayURL) == "" {
+			return nil, constant.SystemErr
+		}
+		_ = data.MarkOrderSelected(parent.TradeId)
+		_ = data.RefreshOrderExpiration(parent.TradeId)
+		order, err := data.GetOrderInfoByTradeId(parent.TradeId)
+		if err != nil {
+			return nil, err
+		}
+		resp := buildCheckoutResponse(order)
+		resp.PaymentUrl = providerRow.PayURL
+		return resp, nil
+	}
+
 	existing, err := data.GetSubOrderByTokenPayProvider(parent.TradeId, token, mdb.PaymentProviderOkPay)
 	if err != nil {
 		return nil, err
@@ -504,16 +850,21 @@ func switchToOkPay(parent *mdb.Orders, token string) (*response.CheckoutCounterR
 		if providerRow.ID == 0 || strings.TrimSpace(providerRow.PayURL) == "" {
 			return nil, constant.SystemErr
 		}
-		_ = data.MarkOrderSelected(parent.TradeId)
+		updated, markErr := data.MarkProviderSwitchParentSelectedWithTransaction(dao.Mdb, parent.TradeId)
+		if markErr != nil {
+			return nil, markErr
+		}
+		if !updated {
+			return nil, constant.OrderStatusConflict
+		}
 		_ = data.MarkOrderSelected(existing.TradeId)
-		_ = data.RefreshOrderExpiration(parent.TradeId)
 		existing.IsSelected = true
 		resp := buildCheckoutResponse(existing)
 		resp.PaymentUrl = providerRow.PayURL
 		return resp, nil
 	}
 
-	count, err := data.CountActiveSubOrders(parent.TradeId)
+	count, err := data.CountSubOrders(parent.TradeId)
 	if err != nil {
 		return nil, err
 	}
@@ -588,16 +939,35 @@ func switchToOkPay(parent *mdb.Orders, token string) (*response.CheckoutCounterR
 	if err != nil {
 		_ = data.MarkProviderOrderFailed(subTradeID, mdb.PaymentProviderOkPay)
 		_ = data.ExpireOrderByTradeID(subTradeID)
-		return nil, err
+		return nil, constant.PaymentProviderCreateErr
 	}
-	if err = data.UpdateProviderOrderCreated(subTradeID, mdb.PaymentProviderOkPay, okpayOrder.ProviderOrderID, okpayOrder.PayURL); err != nil {
+
+	finalizeTx := dao.Mdb.Begin()
+	if err = data.UpdateProviderOrderCreatedWithTransaction(finalizeTx, subTradeID, mdb.PaymentProviderOkPay, okpayOrder.ProviderOrderID, okpayOrder.PayURL); err != nil {
+		finalizeTx.Rollback()
+		_ = data.MarkProviderOrderFailed(subTradeID, mdb.PaymentProviderOkPay)
+		_ = data.ExpireOrderByTradeID(subTradeID)
+		return nil, err
+	}
+	updated, err := data.MarkProviderSwitchParentSelectedWithTransaction(finalizeTx, parent.TradeId)
+	if err != nil {
+		finalizeTx.Rollback()
+		_ = data.MarkProviderOrderFailed(subTradeID, mdb.PaymentProviderOkPay)
+		_ = data.ExpireOrderByTradeID(subTradeID)
+		return nil, err
+	}
+	if !updated {
+		finalizeTx.Rollback()
+		_ = data.MarkProviderOrderFailed(subTradeID, mdb.PaymentProviderOkPay)
+		_ = data.ExpireOrderByTradeID(subTradeID)
+		return nil, constant.OrderStatusConflict
+	}
+	if err = finalizeTx.Commit().Error; err != nil {
+		finalizeTx.Rollback()
 		_ = data.MarkProviderOrderFailed(subTradeID, mdb.PaymentProviderOkPay)
 		_ = data.ExpireOrderByTradeID(subTradeID)
 		return nil, err
 	}
-
-	_ = data.MarkOrderSelected(parent.TradeId)
-	_ = data.RefreshOrderExpiration(parent.TradeId)
 
 	resp := buildCheckoutResponse(subOrder)
 	resp.PaymentUrl = okpayOrder.PayURL

src/model/service/order_service_test.go

@@ -1,8 +1,10 @@
 package service
 
 import (
+	"encoding/base64"
 	"fmt"
 	"io"
+	"math/big"
 	"net/http"
 	"strings"
 	"sync"
@@ -17,6 +19,7 @@ import (
 	"github.com/GMWalletApp/epusdt/util/constant"
 	"github.com/GMWalletApp/epusdt/util/http_client"
 	"github.com/go-resty/resty/v2"
+	"github.com/xssnick/tonutils-go/address"
 )
 
 func newCreateTransactionRequest(orderID string, amount float64) *request.CreateTransactionRequest {
@@ -26,7 +29,7 @@ func newCreateTransactionRequest(orderID string, amount float64) *request.Create
 		Token:     "USDT",
 		Network:   "tron",
 		Amount:    amount,
-		NotifyUrl: "https://merchant.example/callback",
+		NotifyUrl: "https://93.184.216.34/callback",
 	}
 }
 
@@ -36,6 +39,31 @@ func (f roundTripFunc) RoundTrip(req *http.Request) (*http.Response, error) {
 	return f(req)
 }
 
+func TestGenerateCodeFormat(t *testing.T) {
+	tradeID := GenerateCode()
+
+	if len(tradeID) != 24 {
+		t.Fatalf("trade id length = %d, want 24", len(tradeID))
+	}
+	if strings.Contains(tradeID, "=") {
+		t.Fatalf("trade id = %q, contains padding '='", tradeID)
+	}
+	for _, ch := range tradeID {
+		if (ch >= 'a' && ch <= 'z') || (ch >= 'A' && ch <= 'Z') || (ch >= '0' && ch <= '9') || ch == '-' || ch == '_' {
+			continue
+		}
+		t.Fatalf("trade id = %q, contains non URL-safe character %q", tradeID, ch)
+	}
+
+	decoded, err := base64.RawURLEncoding.DecodeString(tradeID)
+	if err != nil {
+		t.Fatalf("decode trade id %q: %v", tradeID, err)
+	}
+	if len(decoded) != 18 {
+		t.Fatalf("decoded trade id length = %d, want 18", len(decoded))
+	}
+}
+
 func installMockHTTPClient(t *testing.T, handler roundTripFunc) {
 	t.Helper()
 
@@ -50,6 +78,94 @@ func installMockHTTPClient(t *testing.T, handler roundTripFunc) {
 	})
 }
 
+func TestCreateTransactionRejectsPrivateNotifyURL(t *testing.T) {
+	req := newCreateTransactionRequest("order_private_notify_url", 1)
+	req.NotifyUrl = "http://127.0.0.1/notify"
+
+	if _, err := CreateTransaction(req, nil); err != constant.NotifyURLErr {
+		t.Fatalf("CreateTransaction error = %v, want %v", err, constant.NotifyURLErr)
+	}
+}
+
+func TestCreateTransactionCreatesWaitSelectPlaceholderWithoutTokenNetwork(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+
+	req := newCreateTransactionRequest("order_wait_select_1", 12.34)
+	req.Token = ""
+	req.Network = ""
+	resp, err := CreateTransaction(req, nil)
+	if err != nil {
+		t.Fatalf("create placeholder transaction: %v", err)
+	}
+	if resp.Status != mdb.StatusWaitSelect {
+		t.Fatalf("response status = %d, want %d", resp.Status, mdb.StatusWaitSelect)
+	}
+	if resp.Token != "" || resp.ReceiveAddress != "" || resp.ActualAmount != 0 {
+		t.Fatalf("placeholder chain fields = token %q address %q actual %.4f", resp.Token, resp.ReceiveAddress, resp.ActualAmount)
+	}
+
+	order, err := data.GetOrderInfoByTradeId(resp.TradeId)
+	if err != nil {
+		t.Fatalf("reload placeholder order: %v", err)
+	}
+	if order.Status != mdb.StatusWaitSelect {
+		t.Fatalf("order status = %d, want %d", order.Status, mdb.StatusWaitSelect)
+	}
+	if order.PaymentType != mdb.PaymentTypeGmpay {
+		t.Fatalf("placeholder payment_type = %q, want %q", order.PaymentType, mdb.PaymentTypeGmpay)
+	}
+	if order.Token != "" || order.Network != "" || order.ReceiveAddress != "" || order.ActualAmount != 0 {
+		t.Fatalf("placeholder order has chain fields: %+v", order)
+	}
+
+	var locks int64
+	if err := dao.RuntimeDB.Model(&mdb.TransactionLock{}).Where("trade_id = ?", resp.TradeId).Count(&locks).Error; err != nil {
+		t.Fatalf("count transaction locks: %v", err)
+	}
+	if locks != 0 {
+		t.Fatalf("placeholder lock count = %d, want 0", locks)
+	}
+}
+
+func TestCreateTransactionRejectsPartialTokenNetwork(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+
+	req := newCreateTransactionRequest("order_partial_token_network_1", 1)
+	req.Token = ""
+	if _, err := CreateTransaction(req, nil); err != constant.ParamsMarshalErr {
+		t.Fatalf("missing token error = %v, want %v", err, constant.ParamsMarshalErr)
+	}
+
+	req = newCreateTransactionRequest("order_partial_token_network_2", 1)
+	req.Network = ""
+	if _, err := CreateTransaction(req, nil); err != constant.ParamsMarshalErr {
+		t.Fatalf("missing network error = %v, want %v", err, constant.ParamsMarshalErr)
+	}
+}
+
+func TestCreateTransactionNormalizesEpayPaymentTypeCase(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+
+	req := newCreateTransactionRequest("order_epay_payment_type_1", 1)
+	req.Token = ""
+	req.Network = ""
+	req.PaymentType = "epay"
+	resp, err := CreateTransaction(req, nil)
+	if err != nil {
+		t.Fatalf("create epay-compatible transaction: %v", err)
+	}
+	order, err := data.GetOrderInfoByTradeId(resp.TradeId)
+	if err != nil {
+		t.Fatalf("reload order: %v", err)
+	}
+	if order.PaymentType != mdb.PaymentTypeEpay {
+		t.Fatalf("payment_type = %q, want %q", order.PaymentType, mdb.PaymentTypeEpay)
+	}
+}
+
 func TestCreateTransactionAssignsIncrementedAmountsAndLocks(t *testing.T) {
 	cleanup := testutil.SetupTestDatabases(t)
 	defer cleanup()
@@ -167,8 +283,8 @@ func TestCreateTransactionUsesRateAPIWhenForcedSettingIsNotPositive(t *testing.T
 		}, nil
 	})
 
-	if err := data.SetSetting("rate", "rate.forced_usdt_rate", "0", "string"); err != nil {
+	if err := data.SetSetting("rate", "rate.forced_rate_list", `{"cny":{"usdt":0}}`, "json"); err != nil {
-		t.Fatalf("set rate.forced_usdt_rate: %v", err)
+		t.Fatalf("set rate.forced_rate_list: %v", err)
 	}
 	if err := data.SetSetting("rate", "rate.api_url", "https://rate.example.test", "string"); err != nil {
 		t.Fatalf("set rate.api_url: %v", err)
@@ -190,8 +306,8 @@ func TestCreateTransactionFailsWhenRateAPIUnavailableAndForcedSettingIsNotPositi
 	cleanup := testutil.SetupTestDatabases(t)
 	defer cleanup()
 
-	if err := data.SetSetting("rate", "rate.forced_usdt_rate", "0", "string"); err != nil {
+	if err := data.SetSetting("rate", "rate.forced_rate_list", `{"cny":{"usdt":0}}`, "json"); err != nil {
-		t.Fatalf("set rate.forced_usdt_rate: %v", err)
+		t.Fatalf("set rate.forced_rate_list: %v", err)
 	}
 	if err := data.SetSetting("rate", "rate.api_url", "", "string"); err != nil {
 		t.Fatalf("clear rate.api_url: %v", err)
@@ -246,6 +362,564 @@ func TestCreateTransactionNormalizesEvmReceiveAddressToLowercase(t *testing.T) {
 	}
 }
 
+func TestCreateTransactionCreatesTonOrderAndRawLock(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+
+	if err := data.SetSetting("rate", "rate.forced_rate_list", `{"cny":{"ton":0.5}}`, "json"); err != nil {
+		t.Fatalf("set forced rate: %v", err)
+	}
+	addr := address.MustParseAddr("EQC6KV4zs8TJtSZapOrRFmqSkxzpq-oSCoxekQRKElf4nC1I")
+	wallet, err := data.AddWalletAddressWithNetwork(mdb.NetworkTon, addr.StringRaw())
+	if err != nil {
+		t.Fatalf("add ton wallet: %v", err)
+	}
+
+	req := newCreateTransactionRequest("order_ton_native_1", 10)
+	req.Network = mdb.NetworkTon
+	req.Token = "TON"
+
+	resp, err := CreateTransaction(req, nil)
+	if err != nil {
+		t.Fatalf("create TON transaction: %v", err)
+	}
+	if resp.ReceiveAddress != wallet.Address {
+		t.Fatalf("receive address = %q, want %q", resp.ReceiveAddress, wallet.Address)
+	}
+	if resp.Token != "TON" {
+		t.Fatalf("token = %q, want TON", resp.Token)
+	}
+	if got := fmt.Sprintf("%.2f", resp.ActualAmount); got != "5.00" {
+		t.Fatalf("actual amount = %s, want 5.00", got)
+	}
+
+	tradeID, err := data.GetTradeIdByWalletAddressAndAmountAndToken(mdb.NetworkTon, addr.StringRaw(), "TON", resp.ActualAmount)
+	if err != nil {
+		t.Fatalf("lookup ton runtime lock: %v", err)
+	}
+	if tradeID != resp.TradeId {
+		t.Fatalf("runtime lock trade_id = %q, want %q", tradeID, resp.TradeId)
+	}
+}
+
+func TestCreateTransactionCreatesTonOrderWithConfiguredPrecision(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+
+	if err := data.SetSetting(mdb.SettingGroupSystem, mdb.SettingKeyAmountPrecision, "4", mdb.SettingTypeInt); err != nil {
+		t.Fatalf("set amount precision: %v", err)
+	}
+	if err := data.SetSetting("rate", "rate.forced_rate_list", `{"cny":{"ton":0.12345}}`, "json"); err != nil {
+		t.Fatalf("set forced rate: %v", err)
+	}
+	addr := address.MustParseAddr("EQC6KV4zs8TJtSZapOrRFmqSkxzpq-oSCoxekQRKElf4nC1I")
+	if _, err := data.AddWalletAddressWithNetwork(mdb.NetworkTon, addr.StringRaw()); err != nil {
+		t.Fatalf("add ton wallet: %v", err)
+	}
+
+	req := newCreateTransactionRequest("order_ton_precision_1", 10)
+	req.Network = mdb.NetworkTon
+	req.Token = "TON"
+	resp, err := CreateTransaction(req, nil)
+	if err != nil {
+		t.Fatalf("create TON transaction: %v", err)
+	}
+	if got := fmt.Sprintf("%.4f", resp.ActualAmount); got != "1.2345" {
+		t.Fatalf("actual amount = %s, want 1.2345", got)
+	}
+	tradeID, err := data.GetTradeIdByWalletAddressAndAmountAndToken(mdb.NetworkTon, addr.Bounce(true).String(), "TON", 1.2345)
+	if err != nil {
+		t.Fatalf("lookup ton runtime lock: %v", err)
+	}
+	if tradeID != resp.TradeId {
+		t.Fatalf("runtime lock trade_id = %q, want %q", tradeID, resp.TradeId)
+	}
+}
+
+func TestCreateTransactionRejectsUnsupportedTonToken(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+
+	req := newCreateTransactionRequest("order_ton_gram_1", 10)
+	req.Network = mdb.NetworkTon
+	req.Token = "GRAM"
+
+	_, err := CreateTransaction(req, nil)
+	if err != constant.SupportedAssetNotFound {
+		t.Fatalf("create unsupported TON token error = %v, want %v", err, constant.SupportedAssetNotFound)
+	}
+}
+
+func TestCreateTransactionRejectsDisabledTonTokenBeforeRate(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+
+	if err := dao.Mdb.Model(&mdb.ChainToken{}).
+		Where("network = ? AND symbol = ?", mdb.NetworkTon, "TON").
+		Update("enabled", false).Error; err != nil {
+		t.Fatalf("disable TON token: %v", err)
+	}
+	req := newCreateTransactionRequest("order_ton_disabled_1", 10)
+	req.Network = mdb.NetworkTon
+	req.Token = "TON"
+
+	_, err := CreateTransaction(req, nil)
+	if err != constant.SupportedAssetNotFound {
+		t.Fatalf("create disabled TON token error = %v, want %v", err, constant.SupportedAssetNotFound)
+	}
+}
+
+func TestCreateTransactionSupportedTonTokenWithoutRateReturnsRateError(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+
+	if err := data.SetSetting("rate", "rate.forced_rate_list", `{"cny":{"ton":0}}`, "json"); err != nil {
+		t.Fatalf("set forced rate: %v", err)
+	}
+	if err := data.SetSetting("rate", "rate.api_url", "", "string"); err != nil {
+		t.Fatalf("clear rate api url: %v", err)
+	}
+	req := newCreateTransactionRequest("order_ton_missing_rate_1", 10)
+	req.Network = mdb.NetworkTon
+	req.Token = "TON"
+
+	_, err := CreateTransaction(req, nil)
+	if err != constant.RateAmountErr {
+		t.Fatalf("create TON without rate error = %v, want %v", err, constant.RateAmountErr)
+	}
+}
+
+func TestSwitchNetworkCreatesTonSubOrderAndRawLock(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+
+	if err := data.SetSetting("rate", "rate.forced_rate_list", `{"cny":{"usdt":0.1,"ton":0.5}}`, "json"); err != nil {
+		t.Fatalf("set forced rate: %v", err)
+	}
+	if _, err := data.AddWalletAddress("TTestTronAddress001"); err != nil {
+		t.Fatalf("add tron wallet: %v", err)
+	}
+	addr := address.MustParseAddr("EQC6KV4zs8TJtSZapOrRFmqSkxzpq-oSCoxekQRKElf4nC1I")
+	wallet, err := data.AddWalletAddressWithNetwork(mdb.NetworkTon, addr.StringRaw())
+	if err != nil {
+		t.Fatalf("add ton wallet: %v", err)
+	}
+
+	parentReq := newCreateTransactionRequest("order_switch_ton_1", 10)
+	parentReq.Network = mdb.NetworkTron
+	parentResp, err := CreateTransaction(parentReq, nil)
+	if err != nil {
+		t.Fatalf("create parent transaction: %v", err)
+	}
+
+	subResp, err := SwitchNetwork(&request.SwitchNetworkRequest{
+		TradeId: parentResp.TradeId,
+		Token:   "TON",
+		Network: mdb.NetworkTon,
+	})
+	if err != nil {
+		t.Fatalf("switch to TON: %v", err)
+	}
+	if subResp.Network != mdb.NetworkTon || subResp.Token != "TON" {
+		t.Fatalf("sub order network/token = %s/%s, want ton/TON", subResp.Network, subResp.Token)
+	}
+	if subResp.ReceiveAddress != wallet.Address {
+		t.Fatalf("sub order receive address = %q, want %q", subResp.ReceiveAddress, wallet.Address)
+	}
+	if got := fmt.Sprintf("%.2f", subResp.ActualAmount); got != "5.00" {
+		t.Fatalf("sub order actual amount = %s, want 5.00", got)
+	}
+	tradeID, err := data.GetTradeIdByWalletAddressAndAmountAndToken(mdb.NetworkTon, addr.StringRaw(), "TON", subResp.ActualAmount)
+	if err != nil {
+		t.Fatalf("lookup TON sub-order lock: %v", err)
+	}
+	if tradeID != subResp.TradeId {
+		t.Fatalf("TON sub-order lock trade_id = %q, want %q", tradeID, subResp.TradeId)
+	}
+}
+
+func TestSwitchNetworkCompletesWaitSelectPlaceholderInPlace(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+
+	if err := data.SetSetting("rate", "rate.forced_rate_list", `{"cny":{"usdt":0.1}}`, "json"); err != nil {
+		t.Fatalf("set forced rate: %v", err)
+	}
+	if _, err := data.AddWalletAddress("TWaitSelectAddress001"); err != nil {
+		t.Fatalf("add tron wallet: %v", err)
+	}
+
+	req := newCreateTransactionRequest("order_wait_select_switch_1", 10)
+	req.Token = ""
+	req.Network = ""
+	parentResp, err := CreateTransaction(req, nil)
+	if err != nil {
+		t.Fatalf("create placeholder: %v", err)
+	}
+	if parentResp.Status != mdb.StatusWaitSelect {
+		t.Fatalf("parent response status = %d, want %d", parentResp.Status, mdb.StatusWaitSelect)
+	}
+
+	switched, err := SwitchNetwork(&request.SwitchNetworkRequest{
+		TradeId: parentResp.TradeId,
+		Token:   "USDT",
+		Network: mdb.NetworkTron,
+	})
+	if err != nil {
+		t.Fatalf("switch placeholder to tron/usdt: %v", err)
+	}
+	if switched.TradeId != parentResp.TradeId {
+		t.Fatalf("switch returned trade_id = %q, want parent %q", switched.TradeId, parentResp.TradeId)
+	}
+	if switched.Status != mdb.StatusWaitPay {
+		t.Fatalf("switch status = %d, want %d", switched.Status, mdb.StatusWaitPay)
+	}
+	if switched.IsSelected {
+		t.Fatal("switch is_selected = true, want false")
+	}
+	if switched.PaymentUrl != "" {
+		t.Fatalf("switch payment_url = %q, want empty for unselected chain parent", switched.PaymentUrl)
+	}
+	if switched.Token != "USDT" || switched.Network != mdb.NetworkTron || switched.ReceiveAddress != "TWaitSelectAddress001" {
+		t.Fatalf("switch chain fields = token %q network %q address %q", switched.Token, switched.Network, switched.ReceiveAddress)
+	}
+	if got := fmt.Sprintf("%.2f", switched.ActualAmount); got != "1.00" {
+		t.Fatalf("switch actual amount = %s, want 1.00", got)
+	}
+
+	parent, err := data.GetOrderInfoByTradeId(parentResp.TradeId)
+	if err != nil {
+		t.Fatalf("reload parent: %v", err)
+	}
+	if parent.Status != mdb.StatusWaitPay || parent.ParentTradeId != "" {
+		t.Fatalf("parent status/parent_trade_id = %d/%q", parent.Status, parent.ParentTradeId)
+	}
+	if parent.IsSelected {
+		t.Fatal("parent is_selected = true, want false")
+	}
+	if parent.PaymentType != mdb.PaymentTypeGmpay {
+		t.Fatalf("parent payment_type = %q, want %q", parent.PaymentType, mdb.PaymentTypeGmpay)
+	}
+	count, err := data.CountActiveSubOrders(parent.TradeId)
+	if err != nil {
+		t.Fatalf("count sub orders: %v", err)
+	}
+	if count != 0 {
+		t.Fatalf("active sub-order count = %d, want 0", count)
+	}
+	lockTradeID, err := data.GetTradeIdByWalletAddressAndAmountAndToken(mdb.NetworkTron, parent.ReceiveAddress, parent.Token, parent.ActualAmount)
+	if err != nil {
+		t.Fatalf("lookup parent lock: %v", err)
+	}
+	if lockTradeID != parent.TradeId {
+		t.Fatalf("parent lock trade_id = %q, want %q", lockTradeID, parent.TradeId)
+	}
+}
+
+func TestSwitchNetworkAfterWaitSelectCompletionUsesExistingSubOrderFlow(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+
+	if err := data.SetSetting("rate", "rate.forced_rate_list", `{"cny":{"usdt":0.1}}`, "json"); err != nil {
+		t.Fatalf("set forced rate: %v", err)
+	}
+	if _, err := data.AddWalletAddress("TWaitSelectAddress002"); err != nil {
+		t.Fatalf("add tron wallet: %v", err)
+	}
+	if _, err := data.AddWalletAddressWithNetwork(mdb.NetworkEthereum, "0xA1B2c3D4e5F60718293aBcDeF001122334455668"); err != nil {
+		t.Fatalf("add ethereum wallet: %v", err)
+	}
+
+	req := newCreateTransactionRequest("order_wait_select_reswitch_1", 10)
+	req.Token = ""
+	req.Network = ""
+	parentResp, err := CreateTransaction(req, nil)
+	if err != nil {
+		t.Fatalf("create placeholder: %v", err)
+	}
+	first, err := SwitchNetwork(&request.SwitchNetworkRequest{
+		TradeId: parentResp.TradeId,
+		Token:   "USDT",
+		Network: mdb.NetworkTron,
+	})
+	if err != nil {
+		t.Fatalf("first switch: %v", err)
+	}
+
+	second, err := SwitchNetwork(&request.SwitchNetworkRequest{
+		TradeId: parentResp.TradeId,
+		Token:   "USDT",
+		Network: mdb.NetworkEthereum,
+	})
+	if err != nil {
+		t.Fatalf("second switch: %v", err)
+	}
+	if second.TradeId == first.TradeId {
+		t.Fatalf("second switch trade_id = parent %q, want sub-order", second.TradeId)
+	}
+	if second.Network != mdb.NetworkEthereum || second.Token != "USDT" {
+		t.Fatalf("second switch token/network = %s/%s", second.Token, second.Network)
+	}
+	count, err := data.CountActiveSubOrders(parentResp.TradeId)
+	if err != nil {
+		t.Fatalf("count active sub orders: %v", err)
+	}
+	if count != 1 {
+		t.Fatalf("active sub-order count = %d, want 1", count)
+	}
+
+	_, err = SwitchNetwork(&request.SwitchNetworkRequest{
+		TradeId: parentResp.TradeId,
+		Token:   "USDT",
+		Network: mdb.NetworkBsc,
+	})
+	if err != constant.SubOrderLimitExceeded {
+		t.Fatalf("third switch error = %v, want %v", err, constant.SubOrderLimitExceeded)
+	}
+}
+
+func TestSwitchNetworkRejectsUnsupportedTonToken(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+
+	if err := data.SetSetting("rate", "rate.forced_rate_list", `{"cny":{"usdt":0.1}}`, "json"); err != nil {
+		t.Fatalf("set forced rate: %v", err)
+	}
+	if _, err := data.AddWalletAddress("TTestTronAddress002"); err != nil {
+		t.Fatalf("add tron wallet: %v", err)
+	}
+	parentResp, err := CreateTransaction(newCreateTransactionRequest("order_switch_gram_1", 10), nil)
+	if err != nil {
+		t.Fatalf("create parent transaction: %v", err)
+	}
+
+	_, err = SwitchNetwork(&request.SwitchNetworkRequest{
+		TradeId: parentResp.TradeId,
+		Token:   "GRAM",
+		Network: mdb.NetworkTon,
+	})
+	if err != constant.SupportedAssetNotFound {
+		t.Fatalf("switch unsupported TON token error = %v, want %v", err, constant.SupportedAssetNotFound)
+	}
+}
+
+func TestTryProcessTonTransferMarksOrderPaidAndReleasesRawLock(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+
+	if err := data.SetSetting("rate", "rate.forced_rate_list", `{"cny":{"ton":0.5}}`, "json"); err != nil {
+		t.Fatalf("set forced rate: %v", err)
+	}
+	addr := address.MustParseAddr("EQC6KV4zs8TJtSZapOrRFmqSkxzpq-oSCoxekQRKElf4nC1I")
+	if _, err := data.AddWalletAddressWithNetwork(mdb.NetworkTon, addr.StringRaw()); err != nil {
+		t.Fatalf("add ton wallet: %v", err)
+	}
+	req := newCreateTransactionRequest("order_ton_process_1", 10)
+	req.Network = mdb.NetworkTon
+	req.Token = "TON"
+	resp, err := CreateTransaction(req, nil)
+	if err != nil {
+		t.Fatalf("create TON transaction: %v", err)
+	}
+
+	transfer := &TonObservedTransfer{
+		ReceiveAddress: resp.ReceiveAddress,
+		Token:          mdb.ChainToken{BaseModel: mdb.BaseModel{ID: 1}, Network: mdb.NetworkTon, Symbol: "TON", Decimals: 9, Enabled: true},
+		RawAmount:      big.NewInt(5_000_000_000),
+		Amount:         resp.ActualAmount,
+		BlockTimeMs:    time.Now().Add(time.Second).UnixMilli(),
+		LT:             100,
+		TxHashHex:      strings.Repeat("1", 64),
+		BlockID:        TonCanonicalBlockTransactionID(addr.StringRaw(), 100, strings.Repeat("1", 64)),
+	}
+	TryProcessTonTransfer(transfer)
+
+	order, err := data.GetOrderInfoByTradeId(resp.TradeId)
+	if err != nil {
+		t.Fatalf("reload order: %v", err)
+	}
+	if order.Status != mdb.StatusPaySuccess {
+		t.Fatalf("order status = %d, want %d", order.Status, mdb.StatusPaySuccess)
+	}
+	if order.BlockTransactionId != transfer.BlockID {
+		t.Fatalf("block transaction id = %q, want %q", order.BlockTransactionId, transfer.BlockID)
+	}
+	lock, err := data.GetTradeIdByWalletAddressAndAmountAndToken(mdb.NetworkTon, addr.StringRaw(), "TON", resp.ActualAmount)
+	if err != nil {
+		t.Fatalf("lookup ton lock: %v", err)
+	}
+	if lock != "" {
+		t.Fatalf("TON lock still exists after payment: %s", lock)
+	}
+}
+
+func TestTryProcessTonJettonTransferMarksUSDTOrderPaid(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+
+	if err := data.SetSetting("rate", "rate.forced_rate_list", `{"cny":{"usdt":0.1}}`, "json"); err != nil {
+		t.Fatalf("set forced rate: %v", err)
+	}
+	addr := address.MustParseAddr("EQC6KV4zs8TJtSZapOrRFmqSkxzpq-oSCoxekQRKElf4nC1I")
+	if _, err := data.AddWalletAddressWithNetwork(mdb.NetworkTon, addr.StringRaw()); err != nil {
+		t.Fatalf("add ton wallet: %v", err)
+	}
+	req := newCreateTransactionRequest("order_ton_usdt_process_1", 10)
+	req.Network = mdb.NetworkTon
+	req.Token = "USDT"
+	resp, err := CreateTransaction(req, nil)
+	if err != nil {
+		t.Fatalf("create TON USDT transaction: %v", err)
+	}
+
+	transfer := &TonObservedTransfer{
+		ReceiveAddress: resp.ReceiveAddress,
+		Token:          mdb.ChainToken{BaseModel: mdb.BaseModel{ID: 2}, Network: mdb.NetworkTon, Symbol: "USDT", Decimals: 6, Enabled: true},
+		RawAmount:      big.NewInt(1_000_000),
+		Amount:         resp.ActualAmount,
+		BlockTimeMs:    time.Now().Add(time.Second).UnixMilli(),
+		LT:             110,
+		TxHashHex:      strings.Repeat("4", 64),
+		BlockID:        TonCanonicalBlockTransactionID(addr.StringRaw(), 110, strings.Repeat("4", 64)),
+	}
+	TryProcessTonTransfer(transfer)
+
+	order, err := data.GetOrderInfoByTradeId(resp.TradeId)
+	if err != nil {
+		t.Fatalf("reload order: %v", err)
+	}
+	if order.Status != mdb.StatusPaySuccess {
+		t.Fatalf("order status = %d, want %d", order.Status, mdb.StatusPaySuccess)
+	}
+	if order.BlockTransactionId != transfer.BlockID {
+		t.Fatalf("block transaction id = %q, want %q", order.BlockTransactionId, transfer.BlockID)
+	}
+	lock, err := data.GetTradeIdByWalletAddressAndAmountAndToken(mdb.NetworkTon, addr.StringRaw(), "USDT", resp.ActualAmount)
+	if err != nil {
+		t.Fatalf("lookup TON USDT lock: %v", err)
+	}
+	if lock != "" {
+		t.Fatalf("TON USDT lock still exists after payment: %s", lock)
+	}
+}
+
+func TestTryProcessTonTransferSkipsTransfersBeforeOrderCreation(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+
+	if err := data.SetSetting("rate", "rate.forced_rate_list", `{"cny":{"ton":0.5}}`, "json"); err != nil {
+		t.Fatalf("set forced rate: %v", err)
+	}
+	addr := address.MustParseAddr("EQC6KV4zs8TJtSZapOrRFmqSkxzpq-oSCoxekQRKElf4nC1I")
+	if _, err := data.AddWalletAddressWithNetwork(mdb.NetworkTon, addr.StringRaw()); err != nil {
+		t.Fatalf("add ton wallet: %v", err)
+	}
+	req := newCreateTransactionRequest("order_ton_old_transfer_1", 10)
+	req.Network = mdb.NetworkTon
+	req.Token = "TON"
+	resp, err := CreateTransaction(req, nil)
+	if err != nil {
+		t.Fatalf("create TON transaction: %v", err)
+	}
+	order, err := data.GetOrderInfoByTradeId(resp.TradeId)
+	if err != nil {
+		t.Fatalf("load order: %v", err)
+	}
+
+	TryProcessTonTransfer(&TonObservedTransfer{
+		ReceiveAddress: resp.ReceiveAddress,
+		Token:          mdb.ChainToken{BaseModel: mdb.BaseModel{ID: 1}, Network: mdb.NetworkTon, Symbol: "TON", Decimals: 9, Enabled: true},
+		RawAmount:      big.NewInt(5_000_000_000),
+		Amount:         resp.ActualAmount,
+		BlockTimeMs:    order.CreatedAt.TimestampMilli() - 1,
+		LT:             101,
+		TxHashHex:      strings.Repeat("2", 64),
+		BlockID:        TonCanonicalBlockTransactionID(addr.StringRaw(), 101, strings.Repeat("2", 64)),
+	})
+
+	order, err = data.GetOrderInfoByTradeId(resp.TradeId)
+	if err != nil {
+		t.Fatalf("reload order: %v", err)
+	}
+	if order.Status != mdb.StatusWaitPay {
+		t.Fatalf("order status = %d, want wait-pay", order.Status)
+	}
+	if order.BlockTransactionId != "" {
+		t.Fatalf("old transfer set block transaction id = %q", order.BlockTransactionId)
+	}
+}
+
+func TestTryProcessTonSubOrderPaysParentAndReleasesLocks(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+
+	if err := data.SetSetting("rate", "rate.forced_rate_list", `{"cny":{"usdt":0.1,"ton":0.5}}`, "json"); err != nil {
+		t.Fatalf("set forced rate: %v", err)
+	}
+	if _, err := data.AddWalletAddress("TTestTronAddressForTonSub"); err != nil {
+		t.Fatalf("add tron wallet: %v", err)
+	}
+	addr := address.MustParseAddr("EQC6KV4zs8TJtSZapOrRFmqSkxzpq-oSCoxekQRKElf4nC1I")
+	if _, err := data.AddWalletAddressWithNetwork(mdb.NetworkTon, addr.StringRaw()); err != nil {
+		t.Fatalf("add ton wallet: %v", err)
+	}
+
+	parentReq := newCreateTransactionRequest("order_ton_sub_parent_1", 10)
+	parentReq.Network = mdb.NetworkTron
+	parentResp, err := CreateTransaction(parentReq, nil)
+	if err != nil {
+		t.Fatalf("create parent order: %v", err)
+	}
+	subResp, err := SwitchNetwork(&request.SwitchNetworkRequest{
+		TradeId: parentResp.TradeId,
+		Token:   "TON",
+		Network: mdb.NetworkTon,
+	})
+	if err != nil {
+		t.Fatalf("switch to TON: %v", err)
+	}
+
+	TryProcessTonTransfer(&TonObservedTransfer{
+		ReceiveAddress: subResp.ReceiveAddress,
+		Token:          mdb.ChainToken{BaseModel: mdb.BaseModel{ID: 1}, Network: mdb.NetworkTon, Symbol: "TON", Decimals: 9, Enabled: true},
+		RawAmount:      big.NewInt(5_000_000_000),
+		Amount:         subResp.ActualAmount,
+		BlockTimeMs:    time.Now().Add(time.Second).UnixMilli(),
+		LT:             102,
+		TxHashHex:      strings.Repeat("3", 64),
+		BlockID:        TonCanonicalBlockTransactionID(addr.StringRaw(), 102, strings.Repeat("3", 64)),
+	})
+
+	parent, err := data.GetOrderInfoByTradeId(parentResp.TradeId)
+	if err != nil {
+		t.Fatalf("reload parent order: %v", err)
+	}
+	if parent.Status != mdb.StatusPaySuccess {
+		t.Fatalf("parent status = %d, want paid", parent.Status)
+	}
+	sub, err := data.GetOrderInfoByTradeId(subResp.TradeId)
+	if err != nil {
+		t.Fatalf("reload sub order: %v", err)
+	}
+	if sub.Status != mdb.StatusPaySuccess {
+		t.Fatalf("sub status = %d, want paid", sub.Status)
+	}
+	parentLock, err := data.GetTradeIdByWalletAddressAndAmountAndToken(mdb.NetworkTron, parentResp.ReceiveAddress, parentResp.Token, parentResp.ActualAmount)
+	if err != nil {
+		t.Fatalf("lookup parent lock: %v", err)
+	}
+	if parentLock != "" {
+		t.Fatalf("parent lock still exists: %s", parentLock)
+	}
+	subLock, err := data.GetTradeIdByWalletAddressAndAmountAndToken(mdb.NetworkTon, addr.StringRaw(), "TON", subResp.ActualAmount)
+	if err != nil {
+		t.Fatalf("lookup sub lock: %v", err)
+	}
+	if subLock != "" {
+		t.Fatalf("TON sub-order lock still exists: %s", subLock)
+	}
+}
+
 func TestOrderProcessingMarksPaidAndReleasesLock(t *testing.T) {
 	cleanup := testutil.SetupTestDatabases(t)
 	defer cleanup()
@@ -764,7 +1438,6 @@ func TestOrderProcessingSubOrderExpiresSiblingsAndReleasesLocks(t *testing.T) {
 		t.Fatalf("create parent order: %v", err)
 	}
 
-	// Create two sub-orders on different networks.
 	subEthResp, err := SwitchNetwork(&request.SwitchNetworkRequest{
 		TradeId: parentResp.TradeId,
 		Token:   "usdt",
@@ -774,13 +1447,29 @@ func TestOrderProcessingSubOrderExpiresSiblingsAndReleasesLocks(t *testing.T) {
 		t.Fatalf("switch to ethereum sub-order: %v", err)
 	}
 
-	subBscResp, err := SwitchNetwork(&request.SwitchNetworkRequest{
+	bscTradeID := GenerateCode()
-		TradeId: parentResp.TradeId,
+	bscAddress := strings.ToLower("0xBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB")
-		Token:   "usdt",
+	subBsc := &mdb.Orders{
+		TradeId:         bscTradeID,
+		OrderId:         bscTradeID,
+		ParentTradeId:   parentResp.TradeId,
+		Amount:          parentResp.Amount,
+		Currency:        parentResp.Currency,
+		ActualAmount:    subEthResp.ActualAmount,
+		ReceiveAddress:  bscAddress,
+		Token:           "USDT",
 		Network:         mdb.NetworkBsc,
-	})
+		Status:          mdb.StatusWaitPay,
-	if err != nil {
+		IsSelected:      true,
-		t.Fatalf("switch to bsc sub-order: %v", err)
+		CallBackConfirm: mdb.CallBackConfirmOk,
+		PaymentType:     mdb.PaymentTypeGmpay,
+		PayProvider:     mdb.PaymentProviderOnChain,
+	}
+	if err := dao.Mdb.Create(subBsc).Error; err != nil {
+		t.Fatalf("seed bsc sibling sub-order: %v", err)
+	}
+	if err := data.LockTransaction(mdb.NetworkBsc, bscAddress, "USDT", bscTradeID, subBsc.ActualAmount, time.Hour); err != nil {
+		t.Fatalf("lock bsc sibling amount: %v", err)
 	}
 
 	// Pay the Ethereum sub-order.
@@ -797,12 +1486,12 @@ func TestOrderProcessingSubOrderExpiresSiblingsAndReleasesLocks(t *testing.T) {
 	}
 
 	// BSC sibling must be expired.
-	subBsc, err := data.GetOrderInfoByTradeId(subBscResp.TradeId)
+	reloadedBsc, err := data.GetOrderInfoByTradeId(subBsc.TradeId)
 	if err != nil {
 		t.Fatalf("reload bsc sub-order: %v", err)
 	}
-	if subBsc.Status != mdb.StatusExpired {
+	if reloadedBsc.Status != mdb.StatusExpired {
-		t.Fatalf("bsc sibling status = %d, want %d (expired)", subBsc.Status, mdb.StatusExpired)
+		t.Fatalf("bsc sibling status = %d, want %d (expired)", reloadedBsc.Status, mdb.StatusExpired)
 	}
 
 	// Parent runtime lock must be released.
@@ -817,7 +1506,7 @@ func TestOrderProcessingSubOrderExpiresSiblingsAndReleasesLocks(t *testing.T) {
 
 	// BSC sibling runtime lock must be released.
 	sibLock, err := data.GetTradeIdByWalletAddressAndAmountAndToken(
-		mdb.NetworkBsc, subBscResp.ReceiveAddress, subBscResp.Token, subBscResp.ActualAmount)
+		mdb.NetworkBsc, subBsc.ReceiveAddress, subBsc.Token, subBsc.ActualAmount)
 	if err != nil {
 		t.Fatalf("check bsc sibling runtime lock: %v", err)
 	}

src/model/service/pay_service.go

@@ -1,8 +1,8 @@
 package service
 
 import (
-	"github.com/GMWalletApp/epusdt/config"
 	"github.com/GMWalletApp/epusdt/model/data"
+	"github.com/GMWalletApp/epusdt/model/mdb"
 	"github.com/GMWalletApp/epusdt/model/response"
 	"github.com/GMWalletApp/epusdt/util/constant"
 )
@@ -20,19 +20,15 @@ func GetCheckoutCounterByTradeId(tradeId string) (*response.CheckoutCounterRespo
 	if orderInfo.ID <= 0 {
 		return nil, ErrOrder
 	}
-
+	resp := buildCheckoutResponse(orderInfo)
-	resp := &response.CheckoutCounterResponse{
+	if orderInfo.PayProvider == mdb.PaymentProviderOkPay {
-		TradeId:        orderInfo.TradeId,
+		providerRow, rowErr := data.GetProviderOrderByTradeIDAndProvider(orderInfo.TradeId, mdb.PaymentProviderOkPay)
-		Amount:         orderInfo.Amount,
+		if rowErr != nil {
-		ActualAmount:   orderInfo.ActualAmount,
+			return nil, rowErr
-		Token:          orderInfo.Token,
+		}
-		Currency:       orderInfo.Currency,
+		if providerRow.ID > 0 {
-		ReceiveAddress: orderInfo.ReceiveAddress,
+			resp.PaymentUrl = providerRow.PayURL
-		Network:        orderInfo.Network,
+		}
-		ExpirationTime: orderInfo.CreatedAt.AddMinutes(config.GetOrderExpirationTime()).TimestampMilli(),
-		RedirectUrl:    orderInfo.RedirectUrl,
-		CreatedAt:      orderInfo.CreatedAt.TimestampMilli(),
-		IsSelected:     orderInfo.IsSelected,
 	}
 	return resp, nil
 }

src/model/service/sol_task.go

@@ -5,6 +5,7 @@ import (
 	"errors"
 	"fmt"
 	"math/big"
+	"net/http"
 	"sort"
 	"strings"
 	"sync"
@@ -26,6 +27,14 @@ import (
 // gProcessedSignatures 已处理签名缓存，避免重复调用 getTransaction
 var gProcessedSignatures sync.Map // sig -> unix timestamp
 
+var processSolanaOrder = OrderProcessing
+
+var (
+	solRPCRetryCount   = 5
+	solRPCRetryWait    = 2 * time.Second
+	solRPCRetryMaxWait = 10 * time.Second
+)
+
 type TransferInfo struct {
 	Source      string  // Source address (for SOL) or source ATA (for SPL tokens)
 	Destination string  // Destination address (for SOL) or destination ATA (for SPL tokens)
@@ -150,6 +159,7 @@ func SolCallBack(address string, wg *sync.WaitGroup) {
 	// Process each transaction signature
 	for sigIdx, txSig := range result {
 		sig := txSig.Signature
+		retrySignature := false
 
 		// Skip failed transactions
 		if txSig.Err != nil {
@@ -213,6 +223,7 @@ func SolCallBack(address string, wg *sync.WaitGroup) {
 			tradeID, err := data.GetTradeIdByWalletAddressAndAmountAndToken(mdb.NetworkSolana, address, token, amount)
 			if err != nil {
 				log.Sugar.Errorf("[SOL][%s] sig=%s query transaction_lock failed: %v", address, sig, err)
+				retrySignature = true
 				continue
 			}
 			if tradeID == "" {
@@ -226,6 +237,7 @@ func SolCallBack(address string, wg *sync.WaitGroup) {
 			order, err := data.GetOrderInfoByTradeId(tradeID)
 			if err != nil {
 				log.Sugar.Errorf("[SOL][%s] sig=%s load order failed for trade_id=%s: %v", address, sig, tradeID, err)
+				retrySignature = true
 				continue
 			}
 			log.Sugar.Infof("[SOL][%s] order loaded: trade_id=%s order_id=%s status=%d created_at_ms=%d",
@@ -252,13 +264,14 @@ func SolCallBack(address string, wg *sync.WaitGroup) {
 			}
 			log.Sugar.Infof("[SOL][%s] calling OrderProcessing: trade_id=%s sig=%s token=%s amount=%.2f",
 				address, tradeID, sig, token, amount)
-			err = OrderProcessing(req)
+			err = processSolanaOrder(req)
 			if err != nil {
 				if errors.Is(err, constant.OrderBlockAlreadyProcess) || errors.Is(err, constant.OrderStatusConflict) {
 					log.Sugar.Infof("[SOL][%s] sig=%s already resolved: trade_id=%s reason=%v", address, sig, tradeID, err)
 					continue
 				}
 				log.Sugar.Errorf("[SOL][%s] sig=%s OrderProcessing failed for trade_id=%s: %v", address, sig, tradeID, err)
+				retrySignature = true
 				continue
 			}
 
@@ -268,6 +281,11 @@ func SolCallBack(address string, wg *sync.WaitGroup) {
 			log.Sugar.Infof("[SOL][%s] payment fully processed: trade_id=%s sig=%s", address, tradeID, sig)
 		}
 
+		if retrySignature {
+			log.Sugar.Debugf("[SOL][%s] sig=%s not marked processed because retryable processing failed", address, sig)
+			continue
+		}
+
 		// 标记已处理
 		gProcessedSignatures.Store(sig, time.Now().Unix())
 	}
@@ -282,26 +300,82 @@ type solSignatureResult struct {
 }
 
 func resolveSolanaRpcURL() (string, error) {
-	node, err := data.SelectRpcNode(mdb.NetworkSolana, mdb.RpcNodeTypeHttp)
+	node, err := resolveSolanaRpcNode()
 	if err != nil {
 		return "", err
 	}
-	if node == nil || node.ID == 0 {
-		return "", fmt.Errorf("no enabled %s %s RPC node configured in rpc_nodes", mdb.NetworkSolana, mdb.RpcNodeTypeHttp)
-	}
 	rpcURL := strings.TrimSpace(node.Url)
-	if rpcURL == "" {
-		return "", fmt.Errorf("rpc_nodes id=%d has empty url", node.ID)
-	}
 	return rpcURL, nil
 }
 
+func resolveSolanaRpcNode(excludeIDs ...uint64) (*mdb.RpcNode, error) {
+	node, err := data.SelectGeneralRpcNode(mdb.NetworkSolana, mdb.RpcNodeTypeHttp, excludeIDs...)
+	if err != nil {
+		return nil, err
+	}
+	if node == nil || node.ID == 0 {
+		return nil, fmt.Errorf("no enabled %s %s RPC node configured in rpc_nodes", mdb.NetworkSolana, mdb.RpcNodeTypeHttp)
+	}
+	rpcURL := strings.TrimSpace(node.Url)
+	if rpcURL == "" {
+		return nil, fmt.Errorf("rpc_nodes id=%d has empty url", node.ID)
+	}
+	node.Url = rpcURL
+	return node, nil
+}
+
 // SolRetryClient 发送 Solana JSON-RPC 请求，自动重试
-func SolRetryClient(method string, params []interface{}) ([]byte, error) {
+func SolRetryClient(method string, params []interface{}) (body []byte, err error) {
+	defer func() {
+		if err != nil {
+			data.RecordRpcFailure(mdb.NetworkSolana)
+			return
+		}
+		data.RecordRpcSuccess(mdb.NetworkSolana)
+	}()
+
+	tried := make([]uint64, 0, 3)
+	var lastErr error
+	for attempts := 0; attempts < 3; attempts++ {
+		node, err := resolveSolanaRpcNode(tried...)
+		if err != nil {
+			if lastErr != nil {
+				return nil, lastErr
+			}
+			return nil, err
+		}
+		if len(tried) > 0 {
+			log.Sugar.Warnf("[SOL] trying alternate RPC node method=%s node=%s", method, data.RpcNodeLogLabel(*node))
+		}
+
+		body, err := solRetryClientWithURL(node.Url, method, params)
+		if err == nil {
+			data.RecordRpcNodeSuccess(node.ID)
+			return body, nil
+		}
+
+		lastErr = err
+		failures, cooling := data.RecordRpcNodeFailure(node.ID)
+		nodeLabel := data.RpcNodeLogLabel(*node)
+		if !cooling {
+			log.Sugar.Warnf("[SOL] RPC node failed method=%s node=%s failures=%d/%d", method, nodeLabel, failures, data.RpcFailoverThreshold)
+			return nil, err
+		}
+		log.Sugar.Warnf("[SOL] RPC node reached fail threshold method=%s node=%s, trying another node", method, nodeLabel)
+		tried = append(tried, node.ID)
+	}
+	return nil, lastErr
+}
+
+func solRetryClientWithURL(rpcUrl string, method string, params []interface{}) ([]byte, error) {
+	return solRetryClientWithURLHeaders(rpcUrl, method, params, nil)
+}
+
+func solRetryClientWithURLHeaders(rpcUrl string, method string, params []interface{}, headers http.Header) ([]byte, error) {
 	client := resty.New()
-	client.SetRetryCount(5)
+	client.SetRetryCount(solRPCRetryCount)
-	client.SetRetryWaitTime(2 * time.Second)
+	client.SetRetryWaitTime(solRPCRetryWait)
-	client.SetRetryMaxWaitTime(10 * time.Second)
+	client.SetRetryMaxWaitTime(solRPCRetryMaxWait)
 	client.AddRetryCondition(func(r *resty.Response, err error) bool {
 		if err != nil {
 			return true
@@ -312,14 +386,14 @@ func SolRetryClient(method string, params []interface{}) ([]byte, error) {
 		return false
 	})
 
-	rpcUrl, err := resolveSolanaRpcURL()
+	req := client.R().SetHeader("Content-Type", "application/json")
-	if err != nil {
+	for key, values := range headers {
-		return nil, err
+		for _, value := range values {
+			req.SetHeader(key, value)
+		}
 	}
 
-	resp, err := client.R().
+	resp, err := req.SetBody(map[string]interface{}{
-		SetHeader("Content-Type", "application/json").
-		SetBody(map[string]interface{}{
 		"jsonrpc": "2.0",
 		"id":      1,
 		"method":  method,
@@ -329,8 +403,18 @@ func SolRetryClient(method string, params []interface{}) ([]byte, error) {
 	if err != nil {
 		return nil, err
 	}
+	if resp.StatusCode() >= http.StatusBadRequest {
+		return nil, fmt.Errorf("solana rpc HTTP %d", resp.StatusCode())
+	}
 
 	respBody := resp.Body()
+	if errValue := gjson.GetBytes(respBody, "error"); errValue.Exists() && errValue.Type != gjson.Null {
+		code := errValue.Get("code").String()
+		if code == "" {
+			code = "unknown"
+		}
+		return nil, fmt.Errorf("solana rpc error code=%s", code)
+	}
 
 	return respBody, nil
 }
@@ -367,6 +451,32 @@ func SolGetSignaturesForAddress(address string, limit int, untilSig string, befo
 	return bodyData, nil
 }
 
+func SolGetBlockHeight() (height int64, err error) {
+	defer func() {
+		if err != nil {
+			data.RecordRpcFailure(mdb.NetworkSolana)
+			return
+		}
+		data.RecordRpcSuccess(mdb.NetworkSolana)
+	}()
+
+	rpcURL, err := resolveSolanaRpcURL()
+	if err != nil {
+		return 0, err
+	}
+	bodyData, err := solRetryClientWithURL(rpcURL, "getBlockHeight", []interface{}{
+		map[string]interface{}{"commitment": "finalized"},
+	})
+	if err != nil {
+		return 0, err
+	}
+	height = gjson.GetBytes(bodyData, "result").Int()
+	if height <= 0 {
+		return 0, fmt.Errorf("unexpected getBlockHeight response: %s", string(bodyData))
+	}
+	return height, nil
+}
+
 func SolGetTransaction(sig string) ([]byte, error) {
 	txData, err := SolRetryClient("getTransaction", []interface{}{
 		sig,
@@ -390,6 +500,33 @@ func SolGetTransaction(sig string) ([]byte, error) {
 	return txData, nil
 }
 
+func solGetTransactionWithURL(rpcURL string, sig string) ([]byte, error) {
+	return solGetTransactionWithURLHeaders(rpcURL, sig, nil)
+}
+
+func solGetTransactionWithURLHeaders(rpcURL string, sig string, headers http.Header) ([]byte, error) {
+	txData, err := solRetryClientWithURLHeaders(rpcURL, "getTransaction", []interface{}{
+		sig,
+		map[string]interface{}{
+			"encoding":                       "jsonParsed",
+			"commitment":                     "confirmed",
+			"maxSupportedTransactionVersion": 0, // suport
+		},
+	}, headers)
+	if err != nil {
+		log.Sugar.Errorf("SolRetryClient failed: %v", err)
+		return nil, err
+	}
+
+	errField := gjson.GetBytes(txData, "result.meta.err")
+	if errField.Exists() && errField.Type != gjson.Null {
+		log.Sugar.Warnf("Transaction failed: %v", errField.String())
+		return nil, fmt.Errorf("transaction failed: %s", errField.String())
+	}
+
+	return txData, nil
+}
+
 // isTransferToAddress 判断转账目标是否为指定钱包地址
 func isTransferToAddress(transfer *TransferInfo, targetAddress string) bool {
 	// Native SOL transfer - check destination directly

src/model/service/sol_task_test.go

@@ -2,12 +2,19 @@ package service
 
 import (
 	"encoding/json"
+	"errors"
+	"net/http"
+	"net/http/httptest"
 	"os"
+	"sync"
 	"testing"
+	"time"
 
 	"github.com/GMWalletApp/epusdt/internal/testutil"
 	"github.com/GMWalletApp/epusdt/model/dao"
+	"github.com/GMWalletApp/epusdt/model/data"
 	"github.com/GMWalletApp/epusdt/model/mdb"
+	"github.com/GMWalletApp/epusdt/model/request"
 	"github.com/tidwall/gjson"
 )
 
@@ -21,6 +28,7 @@ func setupSolanaRPCNode(t *testing.T, url string) func() {
 		Type:    mdb.RpcNodeTypeHttp,
 		Weight:  1,
 		Enabled: true,
+		Purpose: mdb.RpcNodePurposeGeneral,
 		Status:  mdb.RpcNodeStatusOk,
 	}
 	if err := dao.Mdb.Create(node).Error; err != nil {
@@ -52,6 +60,443 @@ func TestResolveSolanaRpcURLWithRow(t *testing.T) {
 	}
 }
 
+func TestResolveSolanaRpcURLIgnoresManualVerifyOnly(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+
+	if err := dao.Mdb.Create(&mdb.RpcNode{
+		Network: mdb.NetworkSolana,
+		Url:     "https://paid-solana.example.com",
+		Type:    mdb.RpcNodeTypeHttp,
+		Weight:  100,
+		Enabled: true,
+		Purpose: mdb.RpcNodePurposeManualVerify,
+		Status:  mdb.RpcNodeStatusOk,
+	}).Error; err != nil {
+		t.Fatalf("seed manual rpc_node: %v", err)
+	}
+
+	if got, err := resolveSolanaRpcURL(); err == nil {
+		t.Fatalf("resolveSolanaRpcURL() = %q, nil; want error", got)
+	}
+}
+
+func TestResolveSolanaRpcURLUsesGeneralWhenManualVerifyExists(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+
+	rows := []mdb.RpcNode{
+		{Network: mdb.NetworkSolana, Url: "https://paid-solana.example.com", Type: mdb.RpcNodeTypeHttp, Weight: 100, Enabled: true, Purpose: mdb.RpcNodePurposeManualVerify, Status: mdb.RpcNodeStatusOk},
+		{Network: mdb.NetworkSolana, Url: " https://general-solana.example.com ", Type: mdb.RpcNodeTypeHttp, Weight: 1, Enabled: true, Purpose: mdb.RpcNodePurposeGeneral, Status: mdb.RpcNodeStatusOk},
+	}
+	if err := dao.Mdb.Create(&rows).Error; err != nil {
+		t.Fatalf("seed rpc_nodes: %v", err)
+	}
+
+	got, err := resolveSolanaRpcURL()
+	if err != nil {
+		t.Fatalf("resolveSolanaRpcURL(): %v", err)
+	}
+	if got != "https://general-solana.example.com" {
+		t.Fatalf("resolveSolanaRpcURL() = %q, want general node", got)
+	}
+}
+
+func TestSolGetBlockHeightDoesNotAffectRpcNodeFailover(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+	data.ResetRpcFailoverForTest()
+	data.ResetRpcRuntimeStatsForTest()
+	t.Cleanup(data.ResetRpcFailoverForTest)
+	t.Cleanup(data.ResetRpcRuntimeStatsForTest)
+
+	oldRetryCount := solRPCRetryCount
+	solRPCRetryCount = 0
+	t.Cleanup(func() {
+		solRPCRetryCount = oldRetryCount
+	})
+
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		http.Error(w, "temporary", http.StatusBadGateway)
+	}))
+	defer server.Close()
+
+	node := &mdb.RpcNode{
+		Network: mdb.NetworkSolana,
+		Url:     server.URL,
+		Type:    mdb.RpcNodeTypeHttp,
+		Weight:  1,
+		Enabled: true,
+		Purpose: mdb.RpcNodePurposeGeneral,
+		Status:  mdb.RpcNodeStatusOk,
+	}
+	if err := dao.Mdb.Create(node).Error; err != nil {
+		t.Fatalf("seed solana rpc_node: %v", err)
+	}
+
+	for i := 0; i < data.RpcFailoverThreshold+1; i++ {
+		if _, err := SolGetBlockHeight(); err == nil {
+			t.Fatalf("SolGetBlockHeight attempt %d unexpectedly succeeded", i+1)
+		}
+	}
+
+	if data.IsRpcNodeCoolingDown(node.ID) {
+		t.Fatal("SolGetBlockHeight failures should not affect rpc_node failover cooldown")
+	}
+	stats := data.SnapshotRpcRuntimeStats()
+	if got := stats[mdb.NetworkSolana].FailureCount; got != int64(data.RpcFailoverThreshold+1) {
+		t.Fatalf("solana runtime failure_count = %d, want %d", got, data.RpcFailoverThreshold+1)
+	}
+}
+
+func TestSolRetryClientSwitchesAfterFailureThreshold(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+	data.ResetRpcFailoverForTest()
+	t.Cleanup(data.ResetRpcFailoverForTest)
+	oldRetryCount := solRPCRetryCount
+	oldRetryWait := solRPCRetryWait
+	oldRetryMaxWait := solRPCRetryMaxWait
+	solRPCRetryCount = 0
+	solRPCRetryWait = time.Millisecond
+	solRPCRetryMaxWait = time.Millisecond
+	t.Cleanup(func() {
+		solRPCRetryCount = oldRetryCount
+		solRPCRetryWait = oldRetryWait
+		solRPCRetryMaxWait = oldRetryMaxWait
+	})
+
+	var primaryCalls int
+	primary := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		primaryCalls++
+		http.Error(w, "temporary", http.StatusBadGateway)
+	}))
+	defer primary.Close()
+
+	var backupCalls int
+	backup := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		backupCalls++
+		w.Header().Set("Content-Type", "application/json")
+		_ = json.NewEncoder(w).Encode(map[string]interface{}{
+			"jsonrpc": "2.0",
+			"id":      1,
+			"result":  "ok",
+		})
+	}))
+	defer backup.Close()
+
+	rows := []mdb.RpcNode{
+		{Network: mdb.NetworkSolana, Url: primary.URL, Type: mdb.RpcNodeTypeHttp, Weight: 100, Enabled: true, Purpose: mdb.RpcNodePurposeGeneral, Status: mdb.RpcNodeStatusOk},
+		{Network: mdb.NetworkSolana, Url: backup.URL, Type: mdb.RpcNodeTypeHttp, Weight: 1, Enabled: true, Purpose: mdb.RpcNodePurposeGeneral, Status: mdb.RpcNodeStatusOk},
+	}
+	if err := dao.Mdb.Create(&rows).Error; err != nil {
+		t.Fatalf("seed rpc_nodes: %v", err)
+	}
+
+	for i := 0; i < data.RpcFailoverThreshold-1; i++ {
+		if _, err := SolRetryClient("getHealth", nil); err == nil {
+			t.Fatalf("SolRetryClient attempt %d unexpectedly succeeded", i+1)
+		}
+	}
+	if backupCalls != 0 {
+		t.Fatalf("backup calls before threshold = %d, want 0", backupCalls)
+	}
+
+	body, err := SolRetryClient("getHealth", nil)
+	if err != nil {
+		t.Fatalf("SolRetryClient after threshold: %v", err)
+	}
+	if gjson.GetBytes(body, "result").String() != "ok" {
+		t.Fatalf("response body = %s, want result ok", string(body))
+	}
+	if backupCalls == 0 {
+		t.Fatal("backup RPC was not called after threshold")
+	}
+	if primaryCalls == 0 {
+		t.Fatal("primary RPC was not called")
+	}
+}
+
+func TestSolRetryClientCountsJSONRPCErrorAsNodeFailure(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+	data.ResetRpcFailoverForTest()
+	t.Cleanup(data.ResetRpcFailoverForTest)
+	oldRetryCount := solRPCRetryCount
+	oldRetryWait := solRPCRetryWait
+	oldRetryMaxWait := solRPCRetryMaxWait
+	solRPCRetryCount = 0
+	solRPCRetryWait = time.Millisecond
+	solRPCRetryMaxWait = time.Millisecond
+	t.Cleanup(func() {
+		solRPCRetryCount = oldRetryCount
+		solRPCRetryWait = oldRetryWait
+		solRPCRetryMaxWait = oldRetryMaxWait
+	})
+
+	var primaryCalls int
+	primary := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		primaryCalls++
+		w.Header().Set("Content-Type", "application/json")
+		_ = json.NewEncoder(w).Encode(map[string]interface{}{
+			"jsonrpc": "2.0",
+			"id":      1,
+			"error": map[string]interface{}{
+				"code": -32005,
+			},
+		})
+	}))
+	defer primary.Close()
+
+	var backupCalls int
+	backup := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		backupCalls++
+		w.Header().Set("Content-Type", "application/json")
+		_ = json.NewEncoder(w).Encode(map[string]interface{}{
+			"jsonrpc": "2.0",
+			"id":      1,
+			"result":  "ok",
+		})
+	}))
+	defer backup.Close()
+
+	rows := []mdb.RpcNode{
+		{Network: mdb.NetworkSolana, Url: primary.URL, Type: mdb.RpcNodeTypeHttp, Weight: 100, Enabled: true, Purpose: mdb.RpcNodePurposeGeneral, Status: mdb.RpcNodeStatusOk},
+		{Network: mdb.NetworkSolana, Url: backup.URL, Type: mdb.RpcNodeTypeHttp, Weight: 1, Enabled: true, Purpose: mdb.RpcNodePurposeGeneral, Status: mdb.RpcNodeStatusOk},
+	}
+	if err := dao.Mdb.Create(&rows).Error; err != nil {
+		t.Fatalf("seed rpc_nodes: %v", err)
+	}
+
+	for i := 0; i < data.RpcFailoverThreshold-1; i++ {
+		if _, err := SolRetryClient("getHealth", nil); err == nil {
+			t.Fatalf("SolRetryClient attempt %d unexpectedly succeeded", i+1)
+		}
+	}
+	body, err := SolRetryClient("getHealth", nil)
+	if err != nil {
+		t.Fatalf("SolRetryClient after JSON-RPC error threshold: %v", err)
+	}
+	if gjson.GetBytes(body, "result").String() != "ok" {
+		t.Fatalf("response body = %s, want result ok", string(body))
+	}
+	if primaryCalls < data.RpcFailoverThreshold {
+		t.Fatalf("primary calls = %d, want at least threshold", primaryCalls)
+	}
+	if backupCalls == 0 {
+		t.Fatal("backup RPC was not called after JSON-RPC error threshold")
+	}
+}
+
+func TestSolRetryClientWithURLHeadersForwardsCustomHeaders(t *testing.T) {
+	oldRetryCount := solRPCRetryCount
+	oldRetryWait := solRPCRetryWait
+	oldRetryMaxWait := solRPCRetryMaxWait
+	solRPCRetryCount = 0
+	solRPCRetryWait = time.Millisecond
+	solRPCRetryMaxWait = time.Millisecond
+	t.Cleanup(func() {
+		solRPCRetryCount = oldRetryCount
+		solRPCRetryWait = oldRetryWait
+		solRPCRetryMaxWait = oldRetryMaxWait
+	})
+
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if got := r.Header.Get("X-Test-Header"); got != "test-value" {
+			t.Errorf("X-Test-Header = %q, want test-value", got)
+			http.Error(w, "bad custom header", http.StatusBadRequest)
+			return
+		}
+		w.Header().Set("Content-Type", "application/json")
+		_ = json.NewEncoder(w).Encode(map[string]interface{}{
+			"jsonrpc": "2.0",
+			"id":      1,
+			"result":  "ok",
+		})
+	}))
+	defer server.Close()
+
+	headers := http.Header{}
+	headers.Set("X-Test-Header", "test-value")
+	body, err := solRetryClientWithURLHeaders(server.URL, "getHealth", nil, headers)
+	if err != nil {
+		t.Fatalf("solRetryClientWithURLHeaders(): %v", err)
+	}
+	if gjson.GetBytes(body, "result").String() != "ok" {
+		t.Fatalf("response body = %s, want result ok", string(body))
+	}
+}
+
+func TestSolRetryClientWithURLDoesNotForwardUserIPByDefault(t *testing.T) {
+	oldRetryCount := solRPCRetryCount
+	oldRetryWait := solRPCRetryWait
+	oldRetryMaxWait := solRPCRetryMaxWait
+	solRPCRetryCount = 0
+	solRPCRetryWait = time.Millisecond
+	solRPCRetryMaxWait = time.Millisecond
+	t.Cleanup(func() {
+		solRPCRetryCount = oldRetryCount
+		solRPCRetryWait = oldRetryWait
+		solRPCRetryMaxWait = oldRetryMaxWait
+	})
+
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if got := r.Header.Get("X-USER-IP"); got != "" {
+			t.Errorf("X-USER-IP header = %q, want empty", got)
+			http.Error(w, "unexpected user ip header", http.StatusBadRequest)
+			return
+		}
+		w.Header().Set("Content-Type", "application/json")
+		_ = json.NewEncoder(w).Encode(map[string]interface{}{
+			"jsonrpc": "2.0",
+			"id":      1,
+			"result":  "ok",
+		})
+	}))
+	defer server.Close()
+
+	body, err := solRetryClientWithURL(server.URL, "getHealth", nil)
+	if err != nil {
+		t.Fatalf("solRetryClientWithURL(): %v", err)
+	}
+	if gjson.GetBytes(body, "result").String() != "ok" {
+		t.Fatalf("response body = %s, want result ok", string(body))
+	}
+}
+
+func TestSolCallBackDoesNotCacheSignatureAfterRetryableOrderProcessingError(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+	clearProcessedSignatures()
+	t.Cleanup(clearProcessedSignatures)
+
+	const (
+		address = "2uFTf9TZ8gd7Kg6hkb79TxfaeNpaAgpJ8uVHguv2Yweu"
+		sig     = "retryable-sol-signature"
+		tradeID = "sol-retryable-order-001"
+		amount  = 1.23
+	)
+	blockTime := time.Now().Add(time.Minute).Unix()
+
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		var rpcReq struct {
+			Method string `json:"method"`
+		}
+		if err := json.NewDecoder(r.Body).Decode(&rpcReq); err != nil {
+			http.Error(w, err.Error(), http.StatusBadRequest)
+			return
+		}
+
+		w.Header().Set("Content-Type", "application/json")
+		switch rpcReq.Method {
+		case "getSignaturesForAddress":
+			_ = json.NewEncoder(w).Encode(map[string]interface{}{
+				"jsonrpc": "2.0",
+				"id":      1,
+				"result": []map[string]interface{}{
+					{
+						"signature": sig,
+						"slot":      1,
+						"err":       nil,
+						"blockTime": blockTime,
+					},
+				},
+			})
+		case "getTransaction":
+			_ = json.NewEncoder(w).Encode(map[string]interface{}{
+				"jsonrpc": "2.0",
+				"id":      1,
+				"result": map[string]interface{}{
+					"blockTime": blockTime,
+					"meta":      map[string]interface{}{"err": nil},
+					"transaction": map[string]interface{}{
+						"message": map[string]interface{}{
+							"instructions": []map[string]interface{}{
+								{
+									"programId": SystemProgramID,
+									"parsed": map[string]interface{}{
+										"type": "transfer",
+										"info": map[string]interface{}{
+											"source":      "source-wallet",
+											"destination": address,
+											"lamports":    1_230_000_000,
+										},
+									},
+								},
+							},
+						},
+					},
+				},
+			})
+		default:
+			http.Error(w, "unexpected method "+rpcReq.Method, http.StatusBadRequest)
+		}
+	}))
+	defer server.Close()
+
+	if err := dao.Mdb.Create(&mdb.RpcNode{
+		Network: mdb.NetworkSolana,
+		Url:     server.URL,
+		Type:    mdb.RpcNodeTypeHttp,
+		Weight:  1,
+		Enabled: true,
+		Status:  mdb.RpcNodeStatusOk,
+	}).Error; err != nil {
+		t.Fatalf("seed solana rpc_node: %v", err)
+	}
+	if err := dao.Mdb.Create(&mdb.ChainToken{
+		Network:         mdb.NetworkSolana,
+		Symbol:          "SOL",
+		ContractAddress: "",
+		Decimals:        SOL_Decimals,
+		Enabled:         true,
+	}).Error; err != nil {
+		t.Fatalf("seed SOL chain token: %v", err)
+	}
+	order := &mdb.Orders{
+		TradeId:        tradeID,
+		OrderId:        "merchant-sol-retryable-001",
+		Amount:         100,
+		Currency:       "CNY",
+		ActualAmount:   amount,
+		ReceiveAddress: address,
+		Token:          "SOL",
+		Network:        mdb.NetworkSolana,
+		Status:         mdb.StatusWaitPay,
+	}
+	if err := dao.Mdb.Create(order).Error; err != nil {
+		t.Fatalf("seed order: %v", err)
+	}
+	if err := data.LockTransaction(mdb.NetworkSolana, address, "SOL", tradeID, amount, time.Hour); err != nil {
+		t.Fatalf("lock transaction: %v", err)
+	}
+
+	oldProcessSolanaOrder := processSolanaOrder
+	calls := 0
+	processSolanaOrder = func(req *request.OrderProcessingRequest) error {
+		calls++
+		if req.TradeId != tradeID {
+			t.Fatalf("order processing trade_id = %q, want %q", req.TradeId, tradeID)
+		}
+		return errors.New("temporary database error")
+	}
+	t.Cleanup(func() {
+		processSolanaOrder = oldProcessSolanaOrder
+	})
+
+	var wg sync.WaitGroup
+	wg.Add(1)
+	SolCallBack(address, &wg)
+	wg.Wait()
+
+	if calls != 1 {
+		t.Fatalf("order processing calls = %d, want 1", calls)
+	}
+	if _, ok := gProcessedSignatures.Load(sig); ok {
+		t.Fatalf("signature %s was cached after retryable order processing error", sig)
+	}
+}
+
 func TestSolClientHealthy(t *testing.T) {
 	requireSolanaIntegration(t)
 
@@ -78,6 +523,13 @@ func TestSolClientHealthy(t *testing.T) {
 	}
 }
 
+func clearProcessedSignatures() {
+	gProcessedSignatures.Range(func(key, value interface{}) bool {
+		gProcessedSignatures.Delete(key)
+		return true
+	})
+}
+
 func TestSolClientGetSignaturesForAddress(t *testing.T) {
 	requireSolanaIntegration(t)
 

src/model/service/task_service.go

@@ -18,18 +18,28 @@ import (
 )
 
 func resolveTronNode() (string, string, error) {
-	node, err := data.SelectRpcNode(mdb.NetworkTron, mdb.RpcNodeTypeHttp)
+	node, err := ResolveTronRpcNode()
 	if err != nil {
 		return "", "", err
 	}
+	rpcURL := strings.TrimRight(strings.TrimSpace(node.Url), "/")
+	return rpcURL, node.ApiKey, nil
+}
+
+func ResolveTronRpcNode(excludeIDs ...uint64) (*mdb.RpcNode, error) {
+	node, err := data.SelectGeneralRpcNode(mdb.NetworkTron, mdb.RpcNodeTypeHttp, excludeIDs...)
+	if err != nil {
+		return nil, err
+	}
 	if node == nil || node.ID == 0 {
-		return "", "", fmt.Errorf("no enabled %s %s RPC node configured in rpc_nodes", mdb.NetworkTron, mdb.RpcNodeTypeHttp)
+		return nil, fmt.Errorf("no enabled %s %s RPC node configured in rpc_nodes", mdb.NetworkTron, mdb.RpcNodeTypeHttp)
 	}
 	rpcURL := strings.TrimRight(strings.TrimSpace(node.Url), "/")
 	if rpcURL == "" {
-		return "", "", fmt.Errorf("rpc_nodes id=%d has empty url", node.ID)
+		return nil, fmt.Errorf("rpc_nodes id=%d has empty url", node.ID)
 	}
-	return rpcURL, node.ApiKey, nil
+	node.Url = rpcURL
+	return node, nil
 }
 
 func ResolveTronNode() (string, string, error) {
@@ -257,6 +267,10 @@ func TryProcessEvmERC20Transfer(chainNetwork string, contract common.Address, to
 		log.Sugar.Warnf("[%s-%s][%s] skip trade_id=%s token mismatch order=%s", net, tokenSym, walletAddr, tradeID, order.Token)
 		return
 	}
+	if blockTsMs > 0 && blockTsMs < order.CreatedAt.TimestampMilli() {
+		log.Sugar.Warnf("[%s-%s][%s] skip tx %s because block time %d is before order create time %d", net, tokenSym, walletAddr, txHash, blockTsMs, order.CreatedAt.TimestampMilli())
+		return
+	}
 
 	req := &request.OrderProcessingRequest{
 		ReceiveAddress:     walletAddr,

src/model/service/task_service_test.go

@@ -12,8 +12,24 @@ import (
 	"github.com/GMWalletApp/epusdt/model/mdb"
 	"github.com/GMWalletApp/epusdt/notify"
 	"github.com/ethereum/go-ethereum/common"
+	"gorm.io/gorm/clause"
 )
 
+func upsertTaskServiceTestChainToken(t *testing.T, token mdb.ChainToken) {
+	t.Helper()
+	if err := dao.Mdb.Clauses(clause.OnConflict{
+		Columns: []clause.Column{{Name: "network"}, {Name: "symbol"}},
+		DoUpdates: clause.AssignmentColumns([]string{
+			"contract_address",
+			"decimals",
+			"enabled",
+			"min_amount",
+		}),
+	}).Create(&token).Error; err != nil {
+		t.Fatalf("seed chain token: %v", err)
+	}
+}
+
 func TestSendPaymentNotificationUsesLatestOrderUpdatedAt(t *testing.T) {
 	cleanup := testutil.SetupTestDatabases(t)
 	defer cleanup()
@@ -144,3 +160,66 @@ func TestTryProcessEvmERC20TransferUsesChainTokenContract(t *testing.T) {
 		t.Fatalf("runtime lock still exists for trade_id=%q", lockTradeID)
 	}
 }
+
+func TestTryProcessEvmERC20TransferSkipsTransfersBeforeOrderCreation(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+
+	const (
+		tradeID  = "T202605110002"
+		orderID  = "ORD202605110002"
+		tokenSym = "USDT"
+		amount   = 25.5
+	)
+	contract := common.HexToAddress("0x3333333333333333333333333333333333333333")
+	receiveAddress := common.HexToAddress("0x4444444444444444444444444444444444444444")
+
+	upsertTaskServiceTestChainToken(t, mdb.ChainToken{
+		Network:         mdb.NetworkEthereum,
+		Symbol:          tokenSym,
+		ContractAddress: contract.Hex(),
+		Decimals:        6,
+		Enabled:         true,
+	})
+
+	order := &mdb.Orders{
+		TradeId:        tradeID,
+		OrderId:        orderID,
+		Amount:         100,
+		Currency:       "CNY",
+		ActualAmount:   amount,
+		Token:          tokenSym,
+		Network:        mdb.NetworkEthereum,
+		ReceiveAddress: strings.ToLower(receiveAddress.Hex()),
+		Status:         mdb.StatusWaitPay,
+	}
+	if err := dao.Mdb.Create(order).Error; err != nil {
+		t.Fatalf("seed order: %v", err)
+	}
+	if err := data.LockTransaction(mdb.NetworkEthereum, order.ReceiveAddress, order.Token, order.TradeId, order.ActualAmount, time.Hour); err != nil {
+		t.Fatalf("lock transaction: %v", err)
+	}
+
+	rawValue := big.NewInt(25_500_000) // 25.5 with 6 decimals
+	oldBlockTsMs := order.CreatedAt.TimestampMilli() - 1
+	TryProcessEvmERC20Transfer(mdb.NetworkEthereum, contract, receiveAddress, rawValue, "0xold-hash", oldBlockTsMs)
+
+	got, err := data.GetOrderInfoByTradeId(tradeID)
+	if err != nil {
+		t.Fatalf("load order: %v", err)
+	}
+	if got.Status != mdb.StatusWaitPay {
+		t.Fatalf("order status = %d, want %d", got.Status, mdb.StatusWaitPay)
+	}
+	if got.BlockTransactionId != "" {
+		t.Fatalf("block transaction id = %q, want empty", got.BlockTransactionId)
+	}
+
+	lockTradeID, err := data.GetTradeIdByWalletAddressAndAmountAndToken(mdb.NetworkEthereum, receiveAddress.Hex(), tokenSym, amount)
+	if err != nil {
+		t.Fatalf("lookup retained lock: %v", err)
+	}
+	if lockTradeID != tradeID {
+		t.Fatalf("runtime lock trade_id = %q, want %q", lockTradeID, tradeID)
+	}
+}

src/model/service/task_tron_test.go

@@ -51,6 +51,49 @@ func TestResolveTronNode_WithRow(t *testing.T) {
 	}
 }
 
+func TestResolveTronNodeIgnoresManualVerifyOnly(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+
+	if err := dao.Mdb.Create(&mdb.RpcNode{
+		Network: mdb.NetworkTron,
+		Url:     "https://paid-tron.example.com",
+		Type:    mdb.RpcNodeTypeHttp,
+		ApiKey:  "paid-key",
+		Weight:  100,
+		Enabled: true,
+		Purpose: mdb.RpcNodePurposeManualVerify,
+		Status:  mdb.RpcNodeStatusOk,
+	}).Error; err != nil {
+		t.Fatalf("seed manual rpc_node: %v", err)
+	}
+
+	if gotURL, gotKey, err := resolveTronNode(); err == nil {
+		t.Fatalf("resolveTronNode() = (%q, %q, nil), want error", gotURL, gotKey)
+	}
+}
+
+func TestResolveTronNodeUsesGeneralWhenManualVerifyExists(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+
+	rows := []mdb.RpcNode{
+		{Network: mdb.NetworkTron, Url: "https://paid-tron.example.com", Type: mdb.RpcNodeTypeHttp, ApiKey: "paid-key", Weight: 100, Enabled: true, Purpose: mdb.RpcNodePurposeManualVerify, Status: mdb.RpcNodeStatusOk},
+		{Network: mdb.NetworkTron, Url: "https://general-tron.example.com", Type: mdb.RpcNodeTypeHttp, ApiKey: "general-key", Weight: 1, Enabled: true, Purpose: mdb.RpcNodePurposeGeneral, Status: mdb.RpcNodeStatusOk},
+	}
+	if err := dao.Mdb.Create(&rows).Error; err != nil {
+		t.Fatalf("seed rpc_nodes: %v", err)
+	}
+
+	gotURL, gotKey, err := resolveTronNode()
+	if err != nil {
+		t.Fatalf("resolveTronNode(): %v", err)
+	}
+	if gotURL != "https://general-tron.example.com" || gotKey != "general-key" {
+		t.Fatalf("resolveTronNode() = (%q, %q), want general node", gotURL, gotKey)
+	}
+}
+
 // TestResolveTronNode_DisabledRow verifies that a disabled row is ignored.
 func TestResolveTronNode_DisabledRow(t *testing.T) {
 	cleanup := testutil.SetupTestDatabases(t)

src/model/service/ton_lite_client.go

@@ -0,0 +1,37 @@
+package service
+
+import (
+	"context"
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/xssnick/tonutils-go/liteclient"
+	"github.com/xssnick/tonutils-go/ton"
+)
+
+// ConnectTonLiteAPI builds a tonutils-go API client from a liteserver global
+// config URL. Scanner and manual verification use this same connection setup.
+func ConnectTonLiteAPI(ctx context.Context, configURL string, requestTimeout time.Duration, reconnectLimit int) (ton.APIClientWrapped, func(), error) {
+	configURL = strings.TrimSpace(configURL)
+	if configURL == "" {
+		return nil, func() {}, fmt.Errorf("ton lite config url is empty")
+	}
+	if reconnectLimit <= 0 {
+		reconnectLimit = 3
+	}
+	cfg, err := liteclient.GetConfigFromUrl(ctx, configURL)
+	if err != nil {
+		return nil, func() {}, err
+	}
+	pool := liteclient.NewConnectionPool()
+	pool.SetOnDisconnect(pool.DefaultReconnect(3*time.Second, reconnectLimit))
+	if err = pool.AddConnectionsFromConfig(ctx, cfg); err != nil {
+		pool.Stop()
+		return nil, func() {}, err
+	}
+	base := ton.NewAPIClient(pool, ton.ProofCheckPolicyFast)
+	base.SetTrustedBlockFromConfig(cfg)
+	api := base.WithRetry(2).WithTimeout(requestTimeout).WithLSInfoInErrors()
+	return api, pool.Stop, nil
+}

src/model/service/ton_task.go

@@ -0,0 +1,262 @@
+package service
+
+import (
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"math/big"
+	"strings"
+
+	"github.com/GMWalletApp/epusdt/model/data"
+	"github.com/GMWalletApp/epusdt/model/mdb"
+	"github.com/GMWalletApp/epusdt/model/request"
+	addressutil "github.com/GMWalletApp/epusdt/util/address"
+	"github.com/GMWalletApp/epusdt/util/constant"
+	"github.com/GMWalletApp/epusdt/util/log"
+	"github.com/GMWalletApp/epusdt/util/math"
+	"github.com/shopspring/decimal"
+	"github.com/xssnick/tonutils-go/address"
+	"github.com/xssnick/tonutils-go/tlb"
+	"github.com/xssnick/tonutils-go/ton/jetton"
+	"github.com/xssnick/tonutils-go/tvm/cell"
+)
+
+const (
+	TonNativeSymbol               = "TON"
+	TonTransferNotificationOpcode = 0x7362d09c
+)
+
+type TonObservedTransfer struct {
+	ReceiveAddress string
+	Token          mdb.ChainToken
+	RawAmount      *big.Int
+	Amount         float64
+	BlockTimeMs    int64
+	LT             uint64
+	TxHashHex      string
+	BlockID        string
+	SenderAddress  string
+	JettonWallet   string
+}
+
+func TonCanonicalBlockTransactionID(receiveRaw string, lt uint64, txHashHex string) string {
+	return fmt.Sprintf("ton:%s:%d:%s", strings.ToLower(strings.TrimSpace(receiveRaw)), lt, strings.ToLower(strings.TrimSpace(txHashHex)))
+}
+
+func ParseTonInboundTransfer(tx *tlb.Transaction, receive *address.Address, nativeToken *mdb.ChainToken, jettonWalletTokens map[string]mdb.ChainToken) (*TonObservedTransfer, error) {
+	if tx == nil || receive == nil || tx.IO.In == nil || tx.IO.In.MsgType != tlb.MsgTypeInternal {
+		return nil, nil
+	}
+	if isTonTransactionBounced(tx) {
+		return nil, nil
+	}
+	in := tx.IO.In.AsInternal()
+	if in == nil || in.DstAddr == nil || !in.DstAddr.Equals(receive) {
+		return nil, nil
+	}
+
+	receiveRaw := addressutil.TonRawAddressObjectKey(receive)
+	txHashHex := hex.EncodeToString(tx.Hash)
+	blockID := TonCanonicalBlockTransactionID(receiveRaw, tx.LT, txHashHex)
+	blockTimeMs := int64(tx.Now) * 1000
+	if in.SrcAddr != nil {
+		srcRaw := addressutil.TonRawAddressObjectKey(in.SrcAddr)
+		if token, ok := jettonWalletTokens[srcRaw]; ok {
+			transfer, err := parseTonJettonTransferNotification(in)
+			if err != nil {
+				return nil, nil
+			}
+			amount := tonRawAmountToFloat(transfer.Amount.Nano(), token.Decimals)
+			if amount <= 0 {
+				return nil, nil
+			}
+			if token.MinAmount > 0 && amount < token.MinAmount {
+				return nil, nil
+			}
+			return &TonObservedTransfer{
+				ReceiveAddress: addressutil.NormalizeTonAddressObject(receive),
+				Token:          token,
+				RawAmount:      transfer.Amount.Nano(),
+				Amount:         amount,
+				BlockTimeMs:    blockTimeMs,
+				LT:             tx.LT,
+				TxHashHex:      txHashHex,
+				BlockID:        blockID,
+				SenderAddress:  addressutil.NormalizeTonAddressObject(transfer.Sender),
+				JettonWallet:   addressutil.NormalizeTonAddressObject(in.SrcAddr),
+			}, nil
+		}
+	}
+
+	if tonPayloadIsTransferNotification(in.Body) {
+		return nil, nil
+	}
+	if nativeToken == nil || nativeToken.ID == 0 {
+		return nil, nil
+	}
+	rawNano := in.Amount.Nano()
+	if rawNano == nil || rawNano.Sign() <= 0 {
+		return nil, nil
+	}
+	amount := tonRawAmountToFloat(rawNano, nativeToken.Decimals)
+	if amount <= 0 {
+		return nil, nil
+	}
+	if nativeToken.MinAmount > 0 && amount < nativeToken.MinAmount {
+		return nil, nil
+	}
+	return &TonObservedTransfer{
+		ReceiveAddress: addressutil.NormalizeTonAddressObject(receive),
+		Token:          *nativeToken,
+		RawAmount:      rawNano,
+		Amount:         amount,
+		BlockTimeMs:    blockTimeMs,
+		LT:             tx.LT,
+		TxHashHex:      txHashHex,
+		BlockID:        blockID,
+	}, nil
+}
+
+func TryProcessTonTransfer(transfer *TonObservedTransfer) {
+	if transfer == nil {
+		return
+	}
+	tokenSym := strings.ToUpper(strings.TrimSpace(transfer.Token.Symbol))
+	defer func() {
+		if err := recover(); err != nil {
+			log.Sugar.Errorf("[TON-%s][%s] TryProcessTonTransfer panic: %v", tokenSym, transfer.ReceiveAddress, err)
+		}
+	}()
+
+	receive := strings.TrimSpace(transfer.ReceiveAddress)
+	if tokenSym == "" || receive == "" || transfer.Amount <= 0 || transfer.BlockID == "" {
+		return
+	}
+	log.Sugar.Infof("[TON-%s][%s] observed transfer tx=%s lt=%d amount=%.6f", tokenSym, receive, transfer.BlockID, transfer.LT, transfer.Amount)
+
+	tradeID, err := data.GetTradeIdByWalletAddressAndAmountAndToken(mdb.NetworkTon, receive, tokenSym, transfer.Amount)
+	if err != nil {
+		log.Sugar.Warnf("[TON-%s][%s] lock lookup: %v", tokenSym, receive, err)
+		return
+	}
+	if tradeID == "" {
+		log.Sugar.Infof("[TON-%s][%s] skip unmatched transfer tx=%s amount=%.6f", tokenSym, receive, transfer.BlockID, transfer.Amount)
+		return
+	}
+
+	order, err := data.GetOrderInfoByTradeId(tradeID)
+	if err != nil {
+		log.Sugar.Warnf("[TON-%s][%s] load order: %v", tokenSym, receive, err)
+		return
+	}
+	if strings.ToLower(strings.TrimSpace(order.Network)) != mdb.NetworkTon {
+		log.Sugar.Warnf("[TON-%s][%s] skip trade_id=%s network=%q", tokenSym, receive, tradeID, order.Network)
+		return
+	}
+	if strings.ToUpper(strings.TrimSpace(order.Token)) != tokenSym {
+		log.Sugar.Warnf("[TON-%s][%s] skip trade_id=%s token mismatch order=%s", tokenSym, receive, tradeID, order.Token)
+		return
+	}
+	if !tonOrderAddressMatches(order.ReceiveAddress, receive) {
+		log.Sugar.Warnf("[TON-%s][%s] skip trade_id=%s receive address mismatch order=%s", tokenSym, receive, tradeID, order.ReceiveAddress)
+		return
+	}
+	if transfer.BlockTimeMs > 0 && transfer.BlockTimeMs < order.CreatedAt.TimestampMilli() {
+		log.Sugar.Warnf("[TON-%s][%s] skip tx %s because block time %d is before order create time %d", tokenSym, receive, transfer.BlockID, transfer.BlockTimeMs, order.CreatedAt.TimestampMilli())
+		return
+	}
+
+	req := &request.OrderProcessingRequest{
+		ReceiveAddress:     order.ReceiveAddress,
+		Token:              tokenSym,
+		Network:            mdb.NetworkTon,
+		TradeId:            tradeID,
+		Amount:             transfer.Amount,
+		BlockTransactionId: transfer.BlockID,
+	}
+	err = OrderProcessing(req)
+	if err != nil {
+		if errors.Is(err, constant.OrderBlockAlreadyProcess) || errors.Is(err, constant.OrderStatusConflict) {
+			log.Sugar.Infof("[TON-%s][%s] skip resolved transfer trade_id=%s tx=%s err=%v", tokenSym, receive, tradeID, transfer.BlockID, err)
+			return
+		}
+		log.Sugar.Errorf("[TON-%s][%s] OrderProcessing trade_id=%s tx=%s: %v", tokenSym, receive, tradeID, transfer.BlockID, err)
+		return
+	}
+
+	sendPaymentNotification(order)
+	log.Sugar.Infof("[TON-%s][%s] payment processed trade_id=%s tx=%s", tokenSym, receive, tradeID, transfer.BlockID)
+}
+
+func tonOrderAddressMatches(a, b string) bool {
+	ar, errA := addressutil.TonRawAddressKey(a)
+	br, errB := addressutil.TonRawAddressKey(b)
+	return errA == nil && errB == nil && ar == br
+}
+
+func tonRawAmountToFloat(rawAmount *big.Int, decimals int) float64 {
+	if rawAmount == nil || rawAmount.Sign() <= 0 {
+		return 0
+	}
+	if decimals < 0 {
+		decimals = 0
+	}
+	amount := decimal.NewFromBigInt(rawAmount, -int32(decimals))
+	return math.MustParsePrecFloat64(amount.InexactFloat64(), data.MaxAmountPrecision)
+}
+
+func parseTonJettonTransferNotification(in *tlb.InternalMessage) (*jetton.TransferNotification, error) {
+	if in == nil || in.Body == nil {
+		return nil, fmt.Errorf("missing jetton transfer notification body")
+	}
+	var transfer jetton.TransferNotification
+	if err := tlb.LoadFromCell(&transfer, in.Body.BeginParse()); err != nil {
+		return nil, err
+	}
+	return &transfer, nil
+}
+
+func tonPayloadIsTransferNotification(body *cell.Cell) bool {
+	if body == nil {
+		return false
+	}
+	op, err := body.BeginParse().LoadUInt(32)
+	return err == nil && op == TonTransferNotificationOpcode
+}
+
+func isTonTransactionBounced(tx *tlb.Transaction) bool {
+	if tx == nil {
+		return false
+	}
+	if dsc, ok := tx.Description.(tlb.TransactionDescriptionOrdinary); ok && dsc.BouncePhase != nil {
+		if _, ok = dsc.BouncePhase.Phase.(tlb.BouncePhaseOk); ok {
+			return true
+		}
+	}
+	return false
+}
+
+func EnsureTonTransferMatchesOrder(order *mdb.Orders, transfer *TonObservedTransfer) error {
+	if order == nil || order.ID == 0 {
+		return fmt.Errorf("order not found")
+	}
+	if transfer == nil {
+		return fmt.Errorf("matching ton transfer to order address not found")
+	}
+	if strings.ToLower(strings.TrimSpace(order.Network)) != mdb.NetworkTon {
+		return fmt.Errorf("order network mismatch")
+	}
+	if !strings.EqualFold(order.Token, transfer.Token.Symbol) {
+		return fmt.Errorf("transaction token mismatch")
+	}
+	if !tonOrderAddressMatches(order.ReceiveAddress, transfer.ReceiveAddress) {
+		return fmt.Errorf("transaction recipient mismatch")
+	}
+	if transfer.BlockTimeMs <= 0 || transfer.BlockTimeMs < order.CreatedAt.TimestampMilli() {
+		return fmt.Errorf("transaction predates the order")
+	}
+	if !amountMatchesRaw(order.ActualAmount, transfer.RawAmount, transfer.Token.Decimals) {
+		return fmt.Errorf("transaction amount mismatch")
+	}
+	return nil
+}

src/model/service/ton_task_test.go

@@ -0,0 +1,173 @@
+package service
+
+import (
+	"bytes"
+	"math/big"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/GMWalletApp/epusdt/model/mdb"
+	addressutil "github.com/GMWalletApp/epusdt/util/address"
+	"github.com/xssnick/tonutils-go/address"
+	"github.com/xssnick/tonutils-go/tlb"
+	"github.com/xssnick/tonutils-go/ton/jetton"
+	"github.com/xssnick/tonutils-go/tvm/cell"
+)
+
+func tonTestInboundTx(t *testing.T, src, dst *address.Address, amount tlb.Coins, body *cell.Cell) *tlb.Transaction {
+	t.Helper()
+	return &tlb.Transaction{
+		LT:   123,
+		Now:  uint32(time.Now().Unix()),
+		Hash: bytes.Repeat([]byte{0x11}, 32),
+		IO: struct {
+			In  *tlb.Message      `tlb:"maybe ^"`
+			Out *tlb.MessagesList `tlb:"maybe ^"`
+		}{
+			In: &tlb.Message{
+				MsgType: tlb.MsgTypeInternal,
+				Msg: &tlb.InternalMessage{
+					SrcAddr: src,
+					DstAddr: dst,
+					Amount:  amount,
+					Body:    body,
+				},
+			},
+		},
+	}
+}
+
+func TestParseTonInboundTransferNativeTON(t *testing.T) {
+	receive := address.MustParseAddr("EQC6KV4zs8TJtSZapOrRFmqSkxzpq-oSCoxekQRKElf4nC1I")
+	sender := address.NewAddress(0, 0, bytes.Repeat([]byte{0x22}, 32)).Bounce(false).Testnet(false)
+	native := &mdb.ChainToken{BaseModel: mdb.BaseModel{ID: 1}, Network: mdb.NetworkTon, Symbol: "TON", Decimals: 9, Enabled: true}
+
+	tx := tonTestInboundTx(t, sender, receive, tlb.MustFromTON("1.23"), cell.BeginCell().EndCell())
+	transfer, err := ParseTonInboundTransfer(tx, receive, native, nil)
+	if err != nil {
+		t.Fatalf("ParseTonInboundTransfer(): %v", err)
+	}
+	if transfer == nil {
+		t.Fatal("expected native TON transfer")
+	}
+	if transfer.Token.Symbol != "TON" {
+		t.Fatalf("token = %q, want TON", transfer.Token.Symbol)
+	}
+	if transfer.Amount != 1.23 {
+		t.Fatalf("amount = %v, want 1.23", transfer.Amount)
+	}
+	if transfer.ReceiveAddress != addressutil.NormalizeTonAddressObject(receive) {
+		t.Fatalf("receive address = %q", transfer.ReceiveAddress)
+	}
+	if !strings.HasPrefix(transfer.BlockID, "ton:"+addressutil.TonRawAddressObjectKey(receive)+":123:") {
+		t.Fatalf("block id = %q, want canonical TON prefix", transfer.BlockID)
+	}
+}
+
+func TestParseTonInboundTransferJettonNotification(t *testing.T) {
+	receive := address.MustParseAddr("EQC6KV4zs8TJtSZapOrRFmqSkxzpq-oSCoxekQRKElf4nC1I")
+	sender := address.NewAddress(0, 0, bytes.Repeat([]byte{0x33}, 32)).Bounce(false).Testnet(false)
+	jettonWallet := address.NewAddress(0, 0, bytes.Repeat([]byte{0x44}, 32)).Bounce(false).Testnet(false)
+	native := &mdb.ChainToken{BaseModel: mdb.BaseModel{ID: 1}, Network: mdb.NetworkTon, Symbol: "TON", Decimals: 9, Enabled: true}
+	usdt := mdb.ChainToken{BaseModel: mdb.BaseModel{ID: 2}, Network: mdb.NetworkTon, Symbol: "USDT", Decimals: 6, Enabled: true}
+
+	body, err := tlb.ToCell(jetton.TransferNotification{
+		QueryID:        7,
+		Amount:         tlb.MustFromNano(big.NewInt(1230000), 6),
+		Sender:         sender,
+		ForwardPayload: cell.BeginCell().EndCell(),
+	})
+	if err != nil {
+		t.Fatalf("build jetton notification body: %v", err)
+	}
+
+	tx := tonTestInboundTx(t, jettonWallet, receive, tlb.FromNanoTONU(1), body)
+	transfer, err := ParseTonInboundTransfer(tx, receive, native, map[string]mdb.ChainToken{
+		addressutil.TonRawAddressObjectKey(jettonWallet): usdt,
+	})
+	if err != nil {
+		t.Fatalf("ParseTonInboundTransfer(): %v", err)
+	}
+	if transfer == nil {
+		t.Fatal("expected USDT jetton transfer")
+	}
+	if transfer.Token.Symbol != "USDT" {
+		t.Fatalf("token = %q, want USDT", transfer.Token.Symbol)
+	}
+	if transfer.Amount != 1.23 {
+		t.Fatalf("amount = %v, want 1.23", transfer.Amount)
+	}
+	if transfer.SenderAddress != addressutil.NormalizeTonAddressObject(sender) {
+		t.Fatalf("sender address = %q", transfer.SenderAddress)
+	}
+	if transfer.JettonWallet != addressutil.NormalizeTonAddressObject(jettonWallet) {
+		t.Fatalf("jetton wallet = %q", transfer.JettonWallet)
+	}
+}
+
+func TestParseTonInboundTransferJettonNotificationWithNoGasComputeSkip(t *testing.T) {
+	receive := address.MustParseAddr("EQC6KV4zs8TJtSZapOrRFmqSkxzpq-oSCoxekQRKElf4nC1I")
+	sender := address.NewAddress(0, 0, bytes.Repeat([]byte{0x33}, 32)).Bounce(false).Testnet(false)
+	jettonWallet := address.NewAddress(0, 0, bytes.Repeat([]byte{0x44}, 32)).Bounce(false).Testnet(false)
+	usdt := mdb.ChainToken{BaseModel: mdb.BaseModel{ID: 2}, Network: mdb.NetworkTon, Symbol: "USDT", Decimals: 6, Enabled: true}
+
+	body, err := tlb.ToCell(jetton.TransferNotification{
+		QueryID:        7,
+		Amount:         tlb.MustFromNano(big.NewInt(150000), 6),
+		Sender:         sender,
+		ForwardPayload: cell.BeginCell().EndCell(),
+	})
+	if err != nil {
+		t.Fatalf("build jetton notification body: %v", err)
+	}
+
+	tx := tonTestInboundTx(t, jettonWallet, receive, tlb.FromNanoTONU(1), body)
+	tx.Description = tlb.TransactionDescriptionOrdinary{
+		ComputePhase: tlb.ComputePhase{Phase: tlb.ComputePhaseSkipped{
+			Reason: tlb.ComputeSkipReason{Type: tlb.ComputeSkipReasonNoGas},
+		}},
+		Aborted: true,
+	}
+	transfer, err := ParseTonInboundTransfer(tx, receive, nil, map[string]mdb.ChainToken{
+		addressutil.TonRawAddressObjectKey(jettonWallet): usdt,
+	})
+	if err != nil {
+		t.Fatalf("ParseTonInboundTransfer(): %v", err)
+	}
+	if transfer == nil {
+		t.Fatal("expected no-gas jetton notification to be accepted")
+	}
+	if transfer.Token.Symbol != "USDT" {
+		t.Fatalf("token = %q, want USDT", transfer.Token.Symbol)
+	}
+	if transfer.Amount != 0.15 {
+		t.Fatalf("amount = %v, want 0.15", transfer.Amount)
+	}
+}
+
+func TestParseTonInboundTransferDoesNotCountUntrustedJettonNotificationAsTON(t *testing.T) {
+	receive := address.MustParseAddr("EQC6KV4zs8TJtSZapOrRFmqSkxzpq-oSCoxekQRKElf4nC1I")
+	sender := address.NewAddress(0, 0, bytes.Repeat([]byte{0x33}, 32)).Bounce(false).Testnet(false)
+	untrustedJettonWallet := address.NewAddress(0, 0, bytes.Repeat([]byte{0x55}, 32)).Bounce(false).Testnet(false)
+	native := &mdb.ChainToken{BaseModel: mdb.BaseModel{ID: 1}, Network: mdb.NetworkTon, Symbol: "TON", Decimals: 9, Enabled: true}
+
+	body, err := tlb.ToCell(jetton.TransferNotification{
+		QueryID:        7,
+		Amount:         tlb.MustFromNano(big.NewInt(1230000), 6),
+		Sender:         sender,
+		ForwardPayload: cell.BeginCell().EndCell(),
+	})
+	if err != nil {
+		t.Fatalf("build jetton notification body: %v", err)
+	}
+
+	tx := tonTestInboundTx(t, untrustedJettonWallet, receive, tlb.FromNanoTONU(1), body)
+	transfer, err := ParseTonInboundTransfer(tx, receive, native, nil)
+	if err != nil {
+		t.Fatalf("ParseTonInboundTransfer(): %v", err)
+	}
+	if transfer != nil {
+		t.Fatalf("untrusted jetton notification produced transfer: %#v", transfer)
+	}
+}

src/mq/worker.go

@@ -2,9 +2,7 @@ package mq
 
 import (
 	"errors"
-	"fmt"
 	"net/http"
-	"strconv"
 	"strings"
 	"time"
 
@@ -13,6 +11,7 @@ import (
 	"github.com/GMWalletApp/epusdt/model/data"
 	"github.com/GMWalletApp/epusdt/model/mdb"
 	"github.com/GMWalletApp/epusdt/model/response"
+	"github.com/GMWalletApp/epusdt/model/service"
 	"github.com/GMWalletApp/epusdt/util/http_client"
 	"github.com/GMWalletApp/epusdt/util/log"
 	"github.com/GMWalletApp/epusdt/util/sign"
@@ -25,18 +24,12 @@ import (
 // other secret would produce a signature the merchant can't verify.
 // The admin can resend the callback after fixing the key.
 func resolveOrderApiKey(order *mdb.Orders) (*mdb.ApiKey, error) {
-	if order.ApiKeyID == 0 {
+	row, err := service.ResolveOrderApiKey(order)
-		return nil, fmt.Errorf("order trade_id=%s has no api_key_id", order.TradeId)
+	if err != nil || row == nil || row.ID == 0 {
-	}
-	row, err := data.GetApiKeyByID(order.ApiKeyID)
 		if err != nil {
-		return nil, fmt.Errorf("lookup api_key_id=%d: %w", order.ApiKeyID, err)
+			return nil, err
 		}
-	if row.ID == 0 {
+		return nil, errors.New("api key unavailable")
-		return nil, fmt.Errorf("api_key_id=%d not found (deleted?)", order.ApiKeyID)
-	}
-	if row.Status != mdb.ApiKeyStatusEnable {
-		return nil, fmt.Errorf("api_key_id=%d is disabled", order.ApiKeyID)
 	}
 	return row, nil
 }
@@ -48,10 +41,12 @@ const sqliteBusyRetryAttempts = 3
 type expirableOrder struct {
 	ID             uint64  `gorm:"column:id"`
 	TradeId        string  `gorm:"column:trade_id"`
+	Status         int     `gorm:"column:status"`
 	Network        string  `gorm:"column:network"`
 	ReceiveAddress string  `gorm:"column:receive_address"`
 	Token          string  `gorm:"column:token"`
 	ActualAmount   float64 `gorm:"column:actual_amount"`
+	PayProvider    string  `gorm:"column:pay_provider"`
 }
 
 func runOrderExpirationLoop() {
@@ -91,8 +86,8 @@ func processExpiredOrders() {
 		var orders []expirableOrder
 		err := withSQLiteBusyRetry(func() error {
 			return dao.Mdb.Model(&mdb.Orders{}).
-				Select("id", "trade_id", "network", "receive_address", "token", "actual_amount").
+				Select("id", "trade_id", "status", "network", "receive_address", "token", "actual_amount", "pay_provider").
-				Where("status = ?", mdb.StatusWaitPay).
+				Where("status IN ?", []int{mdb.StatusWaitPay, mdb.StatusWaitSelect}).
 				Where("created_at <= ?", expirationCutoff).
 				Order("id asc").
 				Limit(batchSize).
@@ -115,6 +110,17 @@ func processExpiredOrders() {
 			if !expired {
 				continue
 			}
+			// StatusWaitSelect placeholders have not reserved a wallet or
+			// amount yet, so there is no transaction lock to release.
+			if order.Status == mdb.StatusWaitSelect {
+				continue
+			}
+			if strings.TrimSpace(order.PayProvider) != "" && order.PayProvider != mdb.PaymentProviderOnChain {
+				continue
+			}
+			if strings.TrimSpace(order.Network) == "" || strings.TrimSpace(order.ReceiveAddress) == "" || strings.TrimSpace(order.Token) == "" || order.ActualAmount <= 0 {
+				continue
+			}
 			if err = data.UnLockTransaction(order.Network, order.ReceiveAddress, order.Token, order.ActualAmount); err != nil {
 				log.Sugar.Warnf("[mq] release expired transaction lock failed, trade_id=%s, err=%v", order.TradeId, err)
 			}
@@ -192,40 +198,13 @@ func sendOrderCallback(order *mdb.Orders) error {
 		return errors.New("no api key row available for callback")
 	}
 
-	switch order.PaymentType {
+	switch {
-	case mdb.PaymentTypeEpay:
+	case strings.EqualFold(order.PaymentType, mdb.PaymentTypeEpay):
-		// EPAY uses pid (integer) and secret_key as "key".
+		formData, err := service.BuildEPayResultParams(order, apiKeyRow)
-		pidInt, convErr := strconv.Atoi(apiKeyRow.Pid)
-		if convErr != nil {
-			return fmt.Errorf("epay pid not numeric: %s", apiKeyRow.Pid)
-		}
-		notifyData := response.OrderNotifyResponseEpay{
-			PID:         pidInt,
-			TradeNo:     order.TradeId,
-			OutTradeNo:  order.OrderId,
-			Type:        "alipay",
-			Name:        order.Name,
-			Money:       fmt.Sprintf("%.4f", order.Amount),
-			TradeStatus: "TRADE_SUCCESS",
-		}
-
-		signstr2, err := sign.Get(notifyData, apiKeyRow.SecretKey)
 		if err != nil {
 			return err
 		}
 
-		formData := map[string]string{
-			"pid":          fmt.Sprintf("%d", notifyData.PID),
-			"trade_no":     notifyData.TradeNo,
-			"out_trade_no": notifyData.OutTradeNo,
-			"type":         notifyData.Type,
-			"name":         notifyData.Name,
-			"money":        notifyData.Money,
-			"trade_status": notifyData.TradeStatus,
-			"sign":         signstr2,
-			"sign_type":    "MD5",
-		}
-
 		epayResp, err := http_client.GetHttpClient().R().SetQueryParams(formData).Get(order.NotifyUrl)
 		if err != nil {
 			return err

src/mq/worker_test.go

@@ -62,6 +62,21 @@ func TestProcessExpiredOrdersExpiresWaitingOrdersAndReleasesLocks(t *testing.T)
 		t.Fatalf("lock recent order: %v", err)
 	}
 
+	placeholder := &mdb.Orders{
+		TradeId:   "trade_wait_select_expired",
+		OrderId:   "order_wait_select_expired",
+		Amount:    1,
+		Currency:  "CNY",
+		Status:    mdb.StatusWaitSelect,
+		NotifyUrl: "https://merchant.example/callback",
+	}
+	if err := dao.Mdb.Create(placeholder).Error; err != nil {
+		t.Fatalf("create placeholder order: %v", err)
+	}
+	if err := dao.Mdb.Model(placeholder).UpdateColumn("created_at", time.Now().Add(-20*time.Minute)).Error; err != nil {
+		t.Fatalf("age placeholder order: %v", err)
+	}
+
 	processExpiredOrders()
 
 	expired, err := data.GetOrderInfoByTradeId(order.TradeId)
@@ -93,6 +108,14 @@ func TestProcessExpiredOrdersExpiresWaitingOrdersAndReleasesLocks(t *testing.T)
 	if lockTradeID != recentOrder.TradeId {
 		t.Fatalf("recent order lock = %s, want %s", lockTradeID, recentOrder.TradeId)
 	}
+
+	expiredPlaceholder, err := data.GetOrderInfoByTradeId(placeholder.TradeId)
+	if err != nil {
+		t.Fatalf("reload expired placeholder: %v", err)
+	}
+	if expiredPlaceholder.Status != mdb.StatusExpired {
+		t.Fatalf("placeholder status = %d, want %d", expiredPlaceholder.Status, mdb.StatusExpired)
+	}
 }
 
 func TestProcessExpiredOrdersKeepsPaidOrdersPaid(t *testing.T) {
@@ -295,7 +318,7 @@ func TestDispatchPendingCallbacksEpayRequiresAck(t *testing.T) {
 		BlockTransactionId: "block_callback_epay_fail",
 		CallbackNum:        0,
 		CallBackConfirm:    mdb.CallBackConfirmNo,
-		PaymentType:        mdb.PaymentTypeEpay,
+		PaymentType:        "epay",
 		ApiKeyID:           epayKey.ID,
 	}
 	if err := dao.Mdb.Create(order).Error; err != nil {
@@ -349,7 +372,7 @@ func TestDispatchPendingCallbacksEpayAcceptsTrimmedOk(t *testing.T) {
 		BlockTransactionId: "block_callback_epay_ok",
 		CallbackNum:        0,
 		CallBackConfirm:    mdb.CallBackConfirmNo,
-		PaymentType:        mdb.PaymentTypeEpay,
+		PaymentType:        "epay",
 		ApiKeyID:           epayKey.ID,
 	}
 	if err := dao.Mdb.Create(order).Error; err != nil {
@@ -550,7 +573,7 @@ func TestSendOrderCallbackEpayUsesApiKeySecretByPid(t *testing.T) {
 		Status:             mdb.StatusPaySuccess,
 		NotifyUrl:          server.URL,
 		BlockTransactionId: "block_epay_sign",
-		PaymentType:        mdb.PaymentTypeEpay,
+		PaymentType:        "epay",
 		ApiKeyID:           key.ID,
 	}
 

src/route/admin_router_test.go

@@ -1,6 +1,8 @@
 package route
 
 import (
+	"bufio"
+	"context"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -8,11 +10,15 @@ import (
 	"net/http/httptest"
 	"strings"
 	"testing"
+	"time"
 
+	"github.com/GMWalletApp/epusdt/config"
 	"github.com/GMWalletApp/epusdt/model/dao"
 	"github.com/GMWalletApp/epusdt/model/data"
 	"github.com/GMWalletApp/epusdt/model/mdb"
 	"github.com/GMWalletApp/epusdt/model/service"
+	"github.com/GMWalletApp/epusdt/util/constant"
+	appLog "github.com/GMWalletApp/epusdt/util/log"
 	"github.com/labstack/echo/v4"
 )
 
@@ -227,6 +233,7 @@ func TestAdminProtectedRoute_NoToken(t *testing.T) {
 		"/admin/api/v1/wallets",
 		"/admin/api/v1/orders",
 		"/admin/api/v1/dashboard/overview",
+		"/admin/api/v1/dashboard/rpc-stats",
 		"/admin/api/v1/settings",
 		"/admin/api/v1/rpc-nodes",
 		"/admin/api/v1/notification-channels",
@@ -322,13 +329,30 @@ func TestAdminInitPasswordFlow(t *testing.T) {
 	if fetchData["password"] != initPassword {
 		t.Fatalf("expected initial password %s, got %v", initPassword, fetchData["password"])
 	}
+	var plaintextRows int64
+	if err := dao.Mdb.Unscoped().
+		Model(&mdb.Setting{}).
+		Where("`key` = ?", mdb.SettingKeyInitAdminPasswordPlain).
+		Count(&plaintextRows).Error; err != nil {
+		t.Fatalf("count init password plaintext rows: %v", err)
+	}
+	if plaintextRows != 0 {
+		t.Fatalf("expected init password plaintext to be hard-deleted, got %d rows", plaintextRows)
+	}
 
 	recFetch2 := doGet(e, "/admin/api/v1/auth/init-password")
 	if recFetch2.Code != http.StatusBadRequest {
 		t.Fatalf("second fetch should fail with 400, got %d body=%s", recFetch2.Code, recFetch2.Body.String())
 	}
-	if !strings.Contains(strings.ToLower(recFetch2.Body.String()), "already fetched") {
+	var respFetch2 map[string]interface{}
-		t.Fatalf("expected already fetched error, got: %s", recFetch2.Body.String())
+	if err := json.Unmarshal(recFetch2.Body.Bytes(), &respFetch2); err != nil {
+		t.Fatalf("unmarshal second fetch response: %v", err)
+	}
+	if got := int(respFetch2["status_code"].(float64)); got != 10040 {
+		t.Fatalf("second fetch status_code = %d, want 10040; response=%v", got, respFetch2)
+	}
+	if got, _ := respFetch2["message"].(string); got != constant.Errno[10040] {
+		t.Fatalf("second fetch message = %q, want %q; response=%v", got, constant.Errno[10040], respFetch2)
 	}
 
 	token := adminLogin(t, e, testAdminUsername, initPassword)
@@ -511,14 +535,25 @@ func TestAdminRpcNodes_CRUD(t *testing.T) {
 	if nodeID == nil {
 		t.Fatal("CreateRpcNode missing id")
 	}
+	if got, _ := dataObj["purpose"].(string); got != mdb.RpcNodePurposeGeneral {
+		t.Fatalf("created purpose = %q, want %q", got, mdb.RpcNodePurposeGeneral)
+	}
 	nodeIDStr := fmt.Sprintf("%.0f", nodeID.(float64))
 
 	// Update.
 	rec = doPatchAdmin(e, "/admin/api/v1/rpc-nodes/"+nodeIDStr, map[string]interface{}{
 		"url":     "https://eth-mainnet2.example.com",
+		"purpose": mdb.RpcNodePurposeManualVerify,
 	}, token)
 	t.Logf("UpdateRpcNode: %s", rec.Body.String())
 	assertOK(t, rec)
+	updatedNode, err := data.GetRpcNodeByID(uint64(nodeID.(float64)))
+	if err != nil {
+		t.Fatalf("reload rpc node: %v", err)
+	}
+	if updatedNode.Purpose != mdb.RpcNodePurposeManualVerify {
+		t.Fatalf("updated purpose = %q, want %q", updatedNode.Purpose, mdb.RpcNodePurposeManualVerify)
+	}
 
 	// Health check — network likely unreachable in test, but route must not 404/500.
 	rec = doPostAdmin(e, "/admin/api/v1/rpc-nodes/"+nodeIDStr+"/health-check", nil, token)
@@ -533,6 +568,95 @@ func TestAdminRpcNodes_CRUD(t *testing.T) {
 	assertOK(t, rec)
 }
 
+func TestAdminRpcNodes_RejectsURLTypeMismatch(t *testing.T) {
+	e, token := setupAdminTestEnv(t)
+
+	rec := doPostAdmin(e, "/admin/api/v1/rpc-nodes", map[string]interface{}{
+		"network": "ethereum",
+		"url":     "wss://eth-mainnet.example.com",
+		"type":    mdb.RpcNodeTypeHttp,
+	}, token)
+	t.Logf("CreateRpcNode(http with wss): status=%d body=%s", rec.Code, rec.Body.String())
+	if rec.Code == http.StatusOK {
+		t.Fatalf("expected create mismatch to fail, got 200: %s", rec.Body.String())
+	}
+	assertErrorCode(t, rec, 10022)
+
+	rec = doPostAdmin(e, "/admin/api/v1/rpc-nodes", map[string]interface{}{
+		"network": "ethereum",
+		"url":     "https://eth-mainnet.example.com",
+		"type":    mdb.RpcNodeTypeWs,
+	}, token)
+	t.Logf("CreateRpcNode(ws with https): status=%d body=%s", rec.Code, rec.Body.String())
+	if rec.Code == http.StatusOK {
+		t.Fatalf("expected create mismatch to fail, got 200: %s", rec.Body.String())
+	}
+	assertErrorCode(t, rec, 10023)
+
+	rec = doPostAdmin(e, "/admin/api/v1/rpc-nodes", map[string]interface{}{
+		"network": "ethereum",
+		"url":     "https://eth-mainnet.example.com",
+		"type":    mdb.RpcNodeTypeHttp,
+		"purpose": "invalid-purpose",
+	}, token)
+	t.Logf("CreateRpcNode(invalid purpose): status=%d body=%s", rec.Code, rec.Body.String())
+	if rec.Code == http.StatusOK {
+		t.Fatalf("expected invalid purpose to fail, got 200: %s", rec.Body.String())
+	}
+	assertErrorCode(t, rec, 10020)
+
+	rec = doPostAdmin(e, "/admin/api/v1/rpc-nodes", map[string]interface{}{
+		"network": "ethereum",
+		"url":     "https://eth-mainnet.example.com",
+		"type":    mdb.RpcNodeTypeHttp,
+	}, token)
+	resp := assertOK(t, rec)
+	dataObj, _ := resp["data"].(map[string]interface{})
+	nodeID := uint64(dataObj["id"].(float64))
+	nodeIDStr := fmt.Sprintf("%d", nodeID)
+
+	rec = doPatchAdmin(e, "/admin/api/v1/rpc-nodes/"+nodeIDStr, map[string]interface{}{
+		"url": "wss://eth-mainnet.example.com",
+	}, token)
+	t.Logf("UpdateRpcNode(http with wss): status=%d body=%s", rec.Code, rec.Body.String())
+	if rec.Code == http.StatusOK {
+		t.Fatalf("expected update mismatch to fail, got 200: %s", rec.Body.String())
+	}
+	assertErrorCode(t, rec, 10022)
+
+	node, err := data.GetRpcNodeByID(nodeID)
+	if err != nil {
+		t.Fatalf("reload rpc node: %v", err)
+	}
+	if node.Url != "https://eth-mainnet.example.com" {
+		t.Fatalf("node url changed after rejected update: %q", node.Url)
+	}
+}
+
+func TestAdminPathIDParseErrorUsesParamsErrno(t *testing.T) {
+	e, token := setupAdminTestEnv(t)
+
+	rec := doGetAdmin(e, "/admin/api/v1/api-keys/not-a-number/stats", token)
+	assertErrorCode(t, rec, 10009)
+}
+
+func assertErrorCode(t *testing.T, rec *httptest.ResponseRecorder, wantCode int) {
+	t.Helper()
+	if rec.Code != http.StatusBadRequest {
+		t.Fatalf("expected HTTP 400, got %d: %s", rec.Code, rec.Body.String())
+	}
+	var resp map[string]interface{}
+	if err := json.Unmarshal(rec.Body.Bytes(), &resp); err != nil {
+		t.Fatalf("unmarshal error response: %v", err)
+	}
+	if got := int(resp["status_code"].(float64)); got != wantCode {
+		t.Fatalf("status_code = %d, want %d; response=%v", got, wantCode, resp)
+	}
+	if got, _ := resp["message"].(string); got != constant.Errno[wantCode] {
+		t.Fatalf("message = %q, want %q; response=%v", got, constant.Errno[wantCode], resp)
+	}
+}
+
 // ─── Wallets ─────────────────────────────────────────────────────────────────
 
 // TestAdminWallets_CRUD verifies wallet management routes.
@@ -639,6 +763,34 @@ func TestAdminOrders_CloseNotFound(t *testing.T) {
 	}
 }
 
+func TestAdminOrders_CloseWaitSelectOrder(t *testing.T) {
+	e, token := setupAdminTestEnv(t)
+	order := &mdb.Orders{
+		TradeId:     "trade-admin-close-wait-select",
+		OrderId:     "order-admin-close-wait-select",
+		Amount:      10,
+		Currency:    "CNY",
+		Status:      mdb.StatusWaitSelect,
+		NotifyUrl:   "https://merchant.example/notify",
+		PayProvider: mdb.PaymentProviderOnChain,
+	}
+	if err := dao.Mdb.Create(order).Error; err != nil {
+		t.Fatalf("create wait-select order: %v", err)
+	}
+
+	rec := doPostAdmin(e, "/admin/api/v1/orders/"+order.TradeId+"/close", nil, token)
+	t.Logf("CloseOrder wait-select: status=%d body=%s", rec.Code, rec.Body.String())
+	assertOK(t, rec)
+
+	reloaded, err := data.GetOrderInfoByTradeId(order.TradeId)
+	if err != nil {
+		t.Fatalf("reload order: %v", err)
+	}
+	if reloaded.Status != mdb.StatusExpired {
+		t.Fatalf("status = %d, want %d", reloaded.Status, mdb.StatusExpired)
+	}
+}
+
 // TestAdminOrders_MarkPaidNotFound verifies mark-paid on non-existent order.
 func TestAdminOrders_MarkPaidNotFound(t *testing.T) {
 	e, token := setupAdminTestEnv(t)
@@ -681,9 +833,14 @@ func TestAdminOrders_MarkPaidSuccessAfterVerification(t *testing.T) {
 	})
 	defer restore()
 
-	rec := doPostAdmin(e, "/admin/api/v1/orders/"+order.TradeId+"/mark-paid", map[string]interface{}{
+	jsonBytes, _ := json.Marshal(map[string]interface{}{
 		"block_transaction_id": "block-admin-ok",
-	}, token)
+	})
+	req := httptest.NewRequest(http.MethodPost, "/admin/api/v1/orders/"+order.TradeId+"/mark-paid", strings.NewReader(string(jsonBytes)))
+	req.Header.Set(echo.HeaderContentType, echo.MIMEApplicationJSON)
+	req.Header.Set(echo.HeaderAuthorization, "Bearer "+token)
+	rec := httptest.NewRecorder()
+	e.ServeHTTP(rec, req)
 	t.Logf("MarkOrderPaid success: status=%d body=%s", rec.Code, rec.Body.String())
 	assertOK(t, rec)
 	if !verified {
@@ -846,7 +1003,7 @@ func TestAdminOrders_ResendCallbackRequeuesPaidOrder(t *testing.T) {
 
 // ─── Dashboard ───────────────────────────────────────────────────────────────
 
-// TestAdminDashboard_AllRoutes verifies all dashboard endpoints return 200.
+// TestAdminDashboard_AllRoutes verifies ordinary JSON dashboard endpoints return 200.
 func TestAdminDashboard_AllRoutes(t *testing.T) {
 	e, token := setupAdminTestEnv(t)
 	routes := []string{
@@ -863,6 +1020,306 @@ func TestAdminDashboard_AllRoutes(t *testing.T) {
 	}
 }
 
+func TestAdminDashboardRpcStatsSSE(t *testing.T) {
+	e, token := setupAdminTestEnv(t)
+	data.RecordRpcSuccess("TRON")
+	data.RecordRpcSuccess("tron")
+	data.RecordRpcFailure(" tron ")
+	data.RecordRpcBlockHeight("tron", 64532100)
+
+	server := httptest.NewServer(e)
+	defer server.Close()
+
+	reqCtx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
+	defer cancel()
+	req, err := http.NewRequestWithContext(reqCtx, http.MethodGet, server.URL+"/admin/api/v1/dashboard/rpc-stats", nil)
+	if err != nil {
+		t.Fatalf("new request: %v", err)
+	}
+	req.Header.Set(echo.HeaderAuthorization, "Bearer "+token)
+	req.Header.Set(echo.HeaderAccept, "text/event-stream")
+
+	resp, err := server.Client().Do(req)
+	if err != nil {
+		t.Fatalf("sse request: %v", err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("sse status = %d, want 200", resp.StatusCode)
+	}
+	if ct := resp.Header.Get(echo.HeaderContentType); !strings.Contains(ct, "text/event-stream") {
+		t.Fatalf("content-type = %q, want text/event-stream", ct)
+	}
+
+	reader := bufio.NewReader(resp.Body)
+	var eventName string
+	var dataLine string
+	for {
+		line, err := reader.ReadString('\n')
+		if err != nil {
+			t.Fatalf("read sse line: %v", err)
+		}
+		line = strings.TrimRight(line, "\r\n")
+		if strings.HasPrefix(line, "event: ") {
+			eventName = strings.TrimPrefix(line, "event: ")
+		}
+		if strings.HasPrefix(line, "data: ") {
+			dataLine = strings.TrimPrefix(line, "data: ")
+		}
+		if line == "" && dataLine != "" {
+			break
+		}
+	}
+	if eventName != "rpc_stats" {
+		t.Fatalf("event = %q, want rpc_stats", eventName)
+	}
+
+	var envelope map[string]interface{}
+	if err := json.Unmarshal([]byte(dataLine), &envelope); err != nil {
+		t.Fatalf("unmarshal sse data: %v data=%s", err, dataLine)
+	}
+	if got, _ := envelope["status_code"].(float64); got != 200 {
+		t.Fatalf("sse status_code = %v, want 200", got)
+	}
+	dataObj, ok := envelope["data"].(map[string]interface{})
+	if !ok {
+		t.Fatalf("sse data = %#v, want object", envelope["data"])
+	}
+	rows, ok := dataObj["chains"].([]interface{})
+	if !ok {
+		t.Fatalf("sse chains = %#v, want array", dataObj["chains"])
+	}
+
+	summary, ok := dataObj["summary"].(map[string]interface{})
+	if !ok {
+		t.Fatalf("summary = %#v, want object", dataObj["summary"])
+	}
+	if got, _ := summary["success_count"].(float64); got != 2 {
+		t.Fatalf("summary success_count = %v, want 2", got)
+	}
+	if got, _ := summary["failure_count"].(float64); got != 1 {
+		t.Fatalf("summary failure_count = %v, want 1", got)
+	}
+	if got, _ := summary["success_rate"].(float64); got < 0.666 || got > 0.667 {
+		t.Fatalf("summary success_rate = %v, want about 0.6667", got)
+	}
+
+	var tron map[string]interface{}
+	var solana map[string]interface{}
+	for _, row := range rows {
+		item, _ := row.(map[string]interface{})
+		switch item["network"] {
+		case mdb.NetworkTron:
+			tron = item
+		case mdb.NetworkSolana:
+			solana = item
+		}
+	}
+	if tron == nil {
+		t.Fatalf("missing tron row in %#v", rows)
+	}
+	if got, _ := tron["success_count"].(float64); got != 2 {
+		t.Fatalf("tron success_count = %v, want 2", got)
+	}
+	if got, _ := tron["failure_count"].(float64); got != 1 {
+		t.Fatalf("tron failure_count = %v, want 1", got)
+	}
+	if got, _ := tron["success_rate"].(float64); got < 0.666 || got > 0.667 {
+		t.Fatalf("tron success_rate = %v, want about 0.6667", got)
+	}
+	if got, _ := tron["latest_block_height"].(float64); got != 64532100 {
+		t.Fatalf("tron latest_block_height = %v, want 64532100", got)
+	}
+	if got, _ := tron["last_sync_at"].(string); got == "" {
+		t.Fatalf("tron last_sync_at is empty: %#v", tron)
+	}
+	if got, _ := tron["display_name"].(string); got != "TRON" {
+		t.Fatalf("tron display_name = %q, want TRON", got)
+	}
+	if got, _ := tron["status"].(string); got != "warning" {
+		t.Fatalf("tron status = %q, want warning", got)
+	}
+	if solana == nil {
+		t.Fatalf("missing solana row in %#v", rows)
+	}
+	if got, _ := solana["success_count"].(float64); got != 0 {
+		t.Fatalf("solana success_count = %v, want 0", got)
+	}
+	if got, _ := solana["failure_count"].(float64); got != 0 {
+		t.Fatalf("solana failure_count = %v, want 0", got)
+	}
+	if got, _ := solana["success_rate"].(float64); got != 0 {
+		t.Fatalf("solana success_rate = %v, want 0", got)
+	}
+	if got, _ := solana["last_sync_at"].(string); got != "" {
+		t.Fatalf("solana last_sync_at = %q, want empty", got)
+	}
+	if got, _ := solana["latest_block_height"].(float64); got != 0 {
+		t.Fatalf("solana latest_block_height = %v, want 0", got)
+	}
+	if got, _ := solana["status"].(string); got != "unknown" {
+		t.Fatalf("solana status = %q, want unknown", got)
+	}
+}
+
+func TestAdminDashboard_RangeStatsIncludeHistoricalOrders(t *testing.T) {
+	e, token := setupAdminTestEnv(t)
+	yesterday := time.Now().AddDate(0, 0, -1)
+	createdAt := time.Date(yesterday.Year(), yesterday.Month(), yesterday.Day(), 10, 0, 0, 0, time.Local)
+	updatedAt := createdAt.Add(5 * time.Minute)
+
+	order := &mdb.Orders{
+		TradeId:        "trade-dashboard-yesterday",
+		OrderId:        "order-dashboard-yesterday",
+		Amount:         100,
+		Currency:       "CNY",
+		ActualAmount:   12.5,
+		ReceiveAddress: "TTestDashboardAddress001",
+		Token:          "USDT",
+		Network:        mdb.NetworkTron,
+		Status:         mdb.StatusPaySuccess,
+	}
+	if err := dao.Mdb.Create(order).Error; err != nil {
+		t.Fatalf("create historical order: %v", err)
+	}
+	if err := dao.Mdb.Model(order).Updates(map[string]interface{}{
+		"created_at": createdAt,
+		"updated_at": updatedAt,
+	}).Error; err != nil {
+		t.Fatalf("age historical order: %v", err)
+	}
+
+	todayResp := assertOK(t, doGetAdmin(e, "/admin/api/v1/dashboard/order-stats", token))
+	todayData, _ := todayResp["data"].(map[string]interface{})
+	if got, _ := todayData["order_count"].(float64); got != 0 {
+		t.Fatalf("default order-stats order_count = %v, want 0 for today's range", got)
+	}
+
+	statsResp := assertOK(t, doGetAdmin(e, "/admin/api/v1/dashboard/order-stats?range=7d", token))
+	statsData, _ := statsResp["data"].(map[string]interface{})
+	if got, _ := statsData["order_count"].(float64); got != 1 {
+		t.Fatalf("7d order-stats order_count = %v, want 1", got)
+	}
+	if got, _ := statsData["success_count"].(float64); got != 1 {
+		t.Fatalf("7d order-stats success_count = %v, want 1", got)
+	}
+
+	overviewResp := assertOK(t, doGetAdmin(e, "/admin/api/v1/dashboard/overview?range=7d", token))
+	overviewData, _ := overviewResp["data"].(map[string]interface{})
+	if got, _ := overviewData["order_count"].(float64); got != 1 {
+		t.Fatalf("7d overview order_count = %v, want 1", got)
+	}
+	if got, _ := overviewData["volume"].(float64); got != 12.5 {
+		t.Fatalf("7d overview volume = %v, want 12.5", got)
+	}
+
+	for _, path := range []string{
+		"/admin/api/v1/dashboard/asset-trend?range=7d",
+		"/admin/api/v1/dashboard/revenue-trend?range=7d",
+		"/admin/api/v1/dashboard/asset-trend?range=30d",
+		"/admin/api/v1/dashboard/revenue-trend?range=30d",
+	} {
+		resp := assertOK(t, doGetAdmin(e, path, token))
+		rows, _ := resp["data"].([]interface{})
+		day := createdAt.Format("2006-01-02")
+		found := false
+		for _, row := range rows {
+			item, _ := row.(map[string]interface{})
+			if item["day"] != day {
+				continue
+			}
+			found = true
+			if got, _ := item["order_count"].(float64); got != 1 {
+				t.Fatalf("%s order_count for %s = %v, want 1", path, day, got)
+			}
+			if got, _ := item["success_count"].(float64); got != 1 {
+				t.Fatalf("%s success_count for %s = %v, want 1", path, day, got)
+			}
+			if got, _ := item["actual_amount"].(float64); got != 12.5 {
+				t.Fatalf("%s actual_amount for %s = %v, want 12.5", path, day, got)
+			}
+		}
+		if !found {
+			t.Fatalf("%s missing historical bucket %s: %#v", path, day, rows)
+		}
+	}
+
+	addressResp := assertOK(t, doGetAdmin(e, "/admin/api/v1/dashboard/asset-trend?range=7d&group_by=address", token))
+	addressRows, _ := addressResp["data"].([]interface{})
+	day := createdAt.Format("2006-01-02")
+	foundAddress := false
+	for _, row := range addressRows {
+		item, _ := row.(map[string]interface{})
+		if item["day"] != day || item["address"] != order.ReceiveAddress {
+			continue
+		}
+		foundAddress = true
+		if got, _ := item["actual_amount"].(float64); got != 12.5 {
+			t.Fatalf("address trend actual_amount for %s = %v, want 12.5", day, got)
+		}
+	}
+	if !foundAddress {
+		t.Fatalf("address trend missing historical bucket %s/%s: %#v", day, order.ReceiveAddress, addressRows)
+	}
+}
+
+func TestAdminDashboard_TodayTrendUsesHourlyBuckets(t *testing.T) {
+	e, token := setupAdminTestEnv(t)
+	now := time.Now()
+	createdAt := time.Date(now.Year(), now.Month(), now.Day(), now.Hour(), 0, 0, 0, time.Local)
+	updatedAt := createdAt.Add(2 * time.Minute)
+
+	order := &mdb.Orders{
+		TradeId:        "trade-dashboard-today",
+		OrderId:        "order-dashboard-today",
+		Amount:         80,
+		Currency:       "CNY",
+		ActualAmount:   9.75,
+		ReceiveAddress: "TTestDashboardAddressHourly",
+		Token:          "USDT",
+		Network:        mdb.NetworkTron,
+		Status:         mdb.StatusPaySuccess,
+	}
+	if err := dao.Mdb.Create(order).Error; err != nil {
+		t.Fatalf("create today order: %v", err)
+	}
+	if err := dao.Mdb.Model(order).Updates(map[string]interface{}{
+		"created_at": createdAt,
+		"updated_at": updatedAt,
+	}).Error; err != nil {
+		t.Fatalf("set today order time: %v", err)
+	}
+
+	for _, path := range []string{
+		"/admin/api/v1/dashboard/asset-trend?range=today",
+		"/admin/api/v1/dashboard/revenue-trend?range=today",
+	} {
+		resp := assertOK(t, doGetAdmin(e, path, token))
+		rows, _ := resp["data"].([]interface{})
+		hour := createdAt.Format("2006-01-02 15:00")
+		found := false
+		for _, row := range rows {
+			item, _ := row.(map[string]interface{})
+			if item["day"] != hour {
+				continue
+			}
+			found = true
+			if got, _ := item["order_count"].(float64); got != 1 {
+				t.Fatalf("%s order_count for %s = %v, want 1", path, hour, got)
+			}
+			if got, _ := item["success_count"].(float64); got != 1 {
+				t.Fatalf("%s success_count for %s = %v, want 1", path, hour, got)
+			}
+			if got, _ := item["actual_amount"].(float64); got != 9.75 {
+				t.Fatalf("%s actual_amount for %s = %v, want 9.75", path, hour, got)
+			}
+		}
+		if !found {
+			t.Fatalf("%s missing hourly bucket %s: %#v", path, hour, rows)
+		}
+	}
+}
+
 // ─── Settings ────────────────────────────────────────────────────────────────
 
 // TestAdminSettings_ListAndUpsert verifies listing and upserting settings.
@@ -898,13 +1355,64 @@ func TestAdminSettings_ListAndUpsert(t *testing.T) {
 	// Upsert a setting.
 	rec = doPutAdmin(e, "/admin/api/v1/settings", map[string]interface{}{
 		"items": []map[string]interface{}{
-			{"group": "rate", "key": "rate.forced_usdt_rate", "value": "7.5", "type": "string"},
+			{"group": "rate", "key": mdb.SettingKeyRateForcedRateList, "value": map[string]interface{}{
+				"cny": map[string]interface{}{"usdt": 0.14635},
+				"usd": map[string]interface{}{"usdt": 1},
+			}, "type": "json"},
 		},
 	}, token)
 	t.Logf("UpsertSettings: %s", rec.Body.String())
 	assertOK(t, rec)
 }
 
+func TestAdminSettings_ForcedRateListValidation(t *testing.T) {
+	e, token := setupAdminTestEnv(t)
+
+	rec := doPutAdmin(e, "/admin/api/v1/settings", map[string]interface{}{
+		"items": []map[string]interface{}{
+			{"group": "rate", "key": mdb.SettingKeyRateForcedRateList, "value": map[string]interface{}{
+				" CNY ": map[string]interface{}{" USDT ": 0.14635},
+			}, "type": "string"},
+			{"group": "rate", "key": mdb.SettingKeyRateForcedRateList, "value": `{"cny":`, "type": "json"},
+			{"group": "rate", "key": mdb.SettingKeyRateForcedRateList, "value": map[string]interface{}{
+				"CNY": map[string]interface{}{"USDT": 0.14635},
+				"cny": map[string]interface{}{"usdt": 0.14636},
+			}, "type": "json"},
+		},
+	}, token)
+	resp := assertOK(t, rec)
+	results, ok := resp["data"].([]interface{})
+	if !ok || len(results) != 3 {
+		t.Fatalf("expected three results, got %T %v", resp["data"], resp["data"])
+	}
+	first, _ := results[0].(map[string]interface{})
+	if first["ok"] != true {
+		t.Fatalf("valid forced rate list result = %v", first)
+	}
+	second, _ := results[1].(map[string]interface{})
+	if second["ok"] != false {
+		t.Fatalf("invalid forced rate list result = %v, want ok=false", second)
+	}
+	third, _ := results[2].(map[string]interface{})
+	if third["ok"] != false {
+		t.Fatalf("duplicate forced rate list result = %v, want ok=false", third)
+	}
+
+	if got := data.GetSettingString(mdb.SettingKeyRateForcedRateList, ""); got != `{"cny":{"usdt":0.14635}}` {
+		t.Fatalf("forced rate list value = %q", got)
+	}
+	if rate := config.GetRateForCoin("USDT", "CNY"); rate != 0.14635 {
+		t.Fatalf("GetRateForCoin(USDT, CNY) = %v, want 0.14635", rate)
+	}
+	var row mdb.Setting
+	if err := dao.Mdb.Where("`key` = ?", mdb.SettingKeyRateForcedRateList).Take(&row).Error; err != nil {
+		t.Fatalf("load forced rate list: %v", err)
+	}
+	if row.Type != mdb.SettingTypeJSON {
+		t.Fatalf("forced rate list type = %q, want %q", row.Type, mdb.SettingTypeJSON)
+	}
+}
+
 func TestAdminSettings_AmountPrecisionValidationAndListing(t *testing.T) {
 	e, token := setupAdminTestEnv(t)
 
@@ -962,6 +1470,90 @@ func TestAdminSettings_AmountPrecisionValidationAndListing(t *testing.T) {
 	}
 }
 
+func TestAdminSettings_LogLevelValidationRuntimeUpdateAndReset(t *testing.T) {
+	e, token := setupAdminTestEnv(t)
+	oldLevel := appLog.CurrentLevel()
+	t.Cleanup(func() {
+		_ = appLog.SetLevel(oldLevel)
+	})
+	if err := appLog.SetLevel(mdb.SettingDefaultSystemLogLevel); err != nil {
+		t.Fatalf("reset log level: %v", err)
+	}
+
+	rec := doPutAdmin(e, "/admin/api/v1/settings", map[string]interface{}{
+		"items": []map[string]interface{}{
+			{"group": "system", "key": mdb.SettingKeySystemLogLevel, "value": " DEBUG ", "type": "string"},
+		},
+	}, token)
+	resp := assertOK(t, rec)
+	results, ok := resp["data"].([]interface{})
+	if !ok || len(results) != 1 {
+		t.Fatalf("expected one result, got %T %v", resp["data"], resp["data"])
+	}
+	result, _ := results[0].(map[string]interface{})
+	if result["ok"] != true {
+		t.Fatalf("system.log_level upsert result = %v", result)
+	}
+	if got := appLog.CurrentLevel(); got != "debug" {
+		t.Fatalf("runtime log level = %q, want debug", got)
+	}
+	if got := data.GetSettingString(mdb.SettingKeySystemLogLevel, ""); got != "debug" {
+		t.Fatalf("stored system.log_level = %q, want debug", got)
+	}
+
+	rec = doPutAdmin(e, "/admin/api/v1/settings", map[string]interface{}{
+		"items": []map[string]interface{}{
+			{"group": "system", "key": mdb.SettingKeySystemLogLevel, "value": "fatal", "type": "string"},
+			{"group": "rate", "key": mdb.SettingKeySystemLogLevel, "value": "info", "type": "string"},
+			{"group": "system", "key": mdb.SettingKeySystemLogLevel, "value": "", "type": "string"},
+		},
+	}, token)
+	resp = assertOK(t, rec)
+	results, ok = resp["data"].([]interface{})
+	if !ok || len(results) != 3 {
+		t.Fatalf("expected three results, got %T %v", resp["data"], resp["data"])
+	}
+	for _, item := range results {
+		result, _ := item.(map[string]interface{})
+		if result["ok"] != false {
+			t.Fatalf("invalid system.log_level result = %v, want ok=false", result)
+		}
+	}
+	if got := appLog.CurrentLevel(); got != "debug" {
+		t.Fatalf("invalid upsert changed runtime log level to %q", got)
+	}
+
+	rec = doDeleteAdmin(e, "/admin/api/v1/settings/"+mdb.SettingKeySystemLogLevel, token)
+	assertOK(t, rec)
+	if got := appLog.CurrentLevel(); got != mdb.SettingDefaultSystemLogLevel {
+		t.Fatalf("runtime log level after delete = %q, want %q", got, mdb.SettingDefaultSystemLogLevel)
+	}
+	if got := data.GetSettingString(mdb.SettingKeySystemLogLevel, mdb.SettingDefaultSystemLogLevel); got != mdb.SettingDefaultSystemLogLevel {
+		t.Fatalf("deleted system.log_level fallback = %q, want %q", got, mdb.SettingDefaultSystemLogLevel)
+	}
+
+	rec = doPutAdmin(e, "/admin/api/v1/settings", map[string]interface{}{
+		"items": []map[string]interface{}{
+			{"group": "system", "key": mdb.SettingKeySystemLogLevel, "value": "warn", "type": "string"},
+		},
+	}, token)
+	assertOK(t, rec)
+	if got := appLog.CurrentLevel(); got != "warn" {
+		t.Fatalf("runtime log level after restore = %q, want warn", got)
+	}
+
+	var restored mdb.Setting
+	if err := dao.Mdb.Unscoped().Where("`key` = ?", mdb.SettingKeySystemLogLevel).Take(&restored).Error; err != nil {
+		t.Fatalf("load restored system.log_level unscoped: %v", err)
+	}
+	if restored.DeletedAt.Valid {
+		t.Fatalf("restored system.log_level still has deleted_at=%v", restored.DeletedAt)
+	}
+	if restored.Value != "warn" {
+		t.Fatalf("restored system.log_level value = %q, want warn", restored.Value)
+	}
+}
+
 // TestAdminSettings_DeleteNonExistent verifies deleting a non-existent setting.
 func TestAdminSettings_DeleteNonExistent(t *testing.T) {
 	e, token := setupAdminTestEnv(t)
@@ -973,6 +1565,148 @@ func TestAdminSettings_DeleteNonExistent(t *testing.T) {
 	}
 }
 
+func TestAdminSettings_RejectsPrivateRateAPIURL(t *testing.T) {
+	e, token := setupAdminTestEnv(t)
+
+	rec := doPutAdmin(e, "/admin/api/v1/settings", map[string]interface{}{
+		"items": []map[string]interface{}{
+			{"group": "rate", "key": mdb.SettingKeyRateApiUrl, "value": "http://127.0.0.1:8080/", "type": "string"},
+		},
+	}, token)
+	resp := assertOK(t, rec)
+	results, ok := resp["data"].([]interface{})
+	if !ok || len(results) != 1 {
+		t.Fatalf("expected one result, got %T %v", resp["data"], resp["data"])
+	}
+	result, _ := results[0].(map[string]interface{})
+	if result["ok"] != false {
+		t.Fatalf("private rate.api_url result = %v, want ok=false", result)
+	}
+	if got := int(result["error_code"].(float64)); got != 10043 {
+		t.Fatalf("private rate.api_url error_code = %d, want 10043; result=%v", got, result)
+	}
+	if got, _ := result["error"].(string); got != constant.Errno[10043] {
+		t.Fatalf("private rate.api_url error = %q, want %q", got, constant.Errno[10043])
+	}
+}
+
+func TestAdminSettings_AllowsPublicRateAPIURL(t *testing.T) {
+	e, token := setupAdminTestEnv(t)
+
+	rec := doPutAdmin(e, "/admin/api/v1/settings", map[string]interface{}{
+		"items": []map[string]interface{}{
+			{"group": "rate", "key": mdb.SettingKeyRateApiUrl, "value": "https://93.184.216.34/rate", "type": "string"},
+		},
+	}, token)
+	resp := assertOK(t, rec)
+	results, ok := resp["data"].([]interface{})
+	if !ok || len(results) != 1 {
+		t.Fatalf("expected one result, got %T %v", resp["data"], resp["data"])
+	}
+	result, _ := results[0].(map[string]interface{})
+	if result["ok"] != true {
+		t.Fatalf("public rate.api_url result = %v, want ok=true", result)
+	}
+}
+
+func TestAdminSettings_DeleteThenReupsertRestoresSetting(t *testing.T) {
+	e, token := setupAdminTestEnv(t)
+
+	rec := doPutAdmin(e, "/admin/api/v1/settings", map[string]interface{}{
+		"items": []map[string]interface{}{
+			{"group": "rate", "key": mdb.SettingKeyRateApiUrl, "value": "https://93.184.216.34/rate-old", "type": "string"},
+		},
+	}, token)
+	assertOK(t, rec)
+
+	rec = doDeleteAdmin(e, "/admin/api/v1/settings/"+mdb.SettingKeyRateApiUrl, token)
+	assertOK(t, rec)
+	if got := data.GetSettingString(mdb.SettingKeyRateApiUrl, "fallback"); got != "fallback" {
+		t.Fatalf("deleted setting still in cache/read path: got %q", got)
+	}
+
+	rec = doPutAdmin(e, "/admin/api/v1/settings", map[string]interface{}{
+		"items": []map[string]interface{}{
+			{"group": "rate", "key": mdb.SettingKeyRateApiUrl, "value": "https://93.184.216.34/rate-new", "type": "string"},
+		},
+	}, token)
+	assertOK(t, rec)
+
+	rec = doGetAdmin(e, "/admin/api/v1/settings?group=rate", token)
+	resp := assertOK(t, rec)
+	rows, ok := resp["data"].([]interface{})
+	if !ok {
+		t.Fatalf("expected settings array, got %T", resp["data"])
+	}
+	found := false
+	for _, row := range rows {
+		item, _ := row.(map[string]interface{})
+		if item["key"] == mdb.SettingKeyRateApiUrl {
+			found = true
+			if item["value"] != "https://93.184.216.34/rate-new" {
+				t.Fatalf("rate.api_url value = %v, want new value", item["value"])
+			}
+		}
+	}
+	if !found {
+		t.Fatalf("expected settings list to include restored %s", mdb.SettingKeyRateApiUrl)
+	}
+
+	var restored mdb.Setting
+	if err := dao.Mdb.Unscoped().Where("`key` = ?", mdb.SettingKeyRateApiUrl).Take(&restored).Error; err != nil {
+		t.Fatalf("load restored setting unscoped: %v", err)
+	}
+	if restored.DeletedAt.Valid {
+		t.Fatalf("restored setting still has deleted_at=%v", restored.DeletedAt)
+	}
+}
+
+func TestAdminSettings_DeleteThenReupsertRestoresForcedRateList(t *testing.T) {
+	e, token := setupAdminTestEnv(t)
+
+	rec := doPutAdmin(e, "/admin/api/v1/settings", map[string]interface{}{
+		"items": []map[string]interface{}{
+			{"group": "rate", "key": mdb.SettingKeyRateForcedRateList, "value": map[string]interface{}{
+				"CNY": map[string]interface{}{"USDT": 0.14635},
+			}, "type": "json"},
+		},
+	}, token)
+	assertOK(t, rec)
+
+	rec = doDeleteAdmin(e, "/admin/api/v1/settings/"+mdb.SettingKeyRateForcedRateList, token)
+	assertOK(t, rec)
+	if got := data.GetSettingString(mdb.SettingKeyRateForcedRateList, "fallback"); got != "fallback" {
+		t.Fatalf("deleted forced rate list still in cache/read path: got %q", got)
+	}
+	if got := config.GetRateForCoin("USDT", "CNY"); got != 0 {
+		t.Fatalf("deleted forced rate list still used by rate lookup: got %v", got)
+	}
+
+	rec = doPutAdmin(e, "/admin/api/v1/settings", map[string]interface{}{
+		"items": []map[string]interface{}{
+			{"group": "rate", "key": mdb.SettingKeyRateForcedRateList, "value": map[string]interface{}{
+				"CNY": map[string]interface{}{"USDT": 0.15},
+			}, "type": "json"},
+		},
+	}, token)
+	assertOK(t, rec)
+
+	if got := data.GetSettingString(mdb.SettingKeyRateForcedRateList, ""); got != `{"cny":{"usdt":0.15}}` {
+		t.Fatalf("restored forced rate list = %q", got)
+	}
+	if got := config.GetRateForCoin("USDT", "CNY"); got != 0.15 {
+		t.Fatalf("restored forced rate list lookup = %v, want 0.15", got)
+	}
+
+	var restored mdb.Setting
+	if err := dao.Mdb.Unscoped().Where("`key` = ?", mdb.SettingKeyRateForcedRateList).Take(&restored).Error; err != nil {
+		t.Fatalf("load restored forced rate list unscoped: %v", err)
+	}
+	if restored.DeletedAt.Valid {
+		t.Fatalf("restored forced rate list still has deleted_at=%v", restored.DeletedAt)
+	}
+}
+
 func TestAdminConfig_ExposesOkPayCredentials(t *testing.T) {
 	e, token := setupAdminTestEnv(t)
 	if err := data.SetSetting(mdb.SettingGroupBrand, mdb.SettingKeyBrandCheckoutName, "admin cashier", mdb.SettingTypeString); err != nil {
@@ -1190,7 +1924,7 @@ func TestAdminOrders_ListWithSubExcludesSubOrdersFromTopLevel(t *testing.T) {
 		"currency":     "CNY",
 		"token":        "USDT",
 		"network":      "tron",
-		"notify_url":   "https://merchant.example/callback",
+		"notify_url":   "https://93.184.216.34/callback",
 		"redirect_url": "https://merchant.example/redirect",
 	})
 	rec := doPost(e, "/payments/gmpay/v1/order/create-transaction", parentBody)

src/route/router.go

@@ -8,6 +8,7 @@ import (
 	"io"
 	"net/http"
 	"strconv"
+	"strings"
 
 	"github.com/GMWalletApp/epusdt/controller/admin"
 	"github.com/GMWalletApp/epusdt/controller/comm"
@@ -36,13 +37,17 @@ func RegisterRoute(e *echo.Echo) {
 	})
 
 	payRoute.GET("/checkout-counter-resp/:trade_id", comm.Ctrl.CheckoutCounter)
+	payRoute.GET("/return/:trade_id", comm.Ctrl.ReturnToMerchant)
 	payRoute.GET("/check-status/:trade_id", comm.Ctrl.CheckStatus)
+	payRoute.POST("/submit-tx-hash/:trade_id", comm.Ctrl.SubmitTxHash)
 	payRoute.POST("/switch-network", comm.Ctrl.SwitchNetwork)
 
 	// payment routes
 	paymentRoute := e.Group("/payments")
 
-	// gmpay v1 routes
+	// gmpay v1 routes. CreateTransaction accepts token+network together
+	// for a concrete chain order, or omits both for a status=4 placeholder
+	// that is completed later by /pay/switch-network or routed to OkPay.
 	gmpayV1 := paymentRoute.Group("/gmpay/v1")
 	gmpayV1.POST("/order/create-transaction", comm.Ctrl.CreateTransaction, middleware.CheckApiSign())
 	gmpayV1.GET("/config", comm.Ctrl.GetPublicConfig)
@@ -74,7 +79,7 @@ func RegisterRoute(e *echo.Echo) {
 
 		formParams, err := ctx.FormParams()
 		if err != nil && ctx.Request().Method == http.MethodPost {
-			return comm.Ctrl.FailJson(ctx, fmt.Errorf("invalid epay form params: %w", err))
+			return comm.Ctrl.FailJson(ctx, constant.ParamsMarshalErr)
 		}
 		if err == nil {
 			copyParams(formParams)
@@ -128,16 +133,31 @@ func RegisterRoute(e *echo.Echo) {
 		notifyURL := getString(params, "notify_url")
 		outTradeNo := getString(params, "out_trade_no")
 		returnURL := getString(params, "return_url")
+		token := strings.TrimSpace(getString(params, "token"))
+		if token == "" {
+			token = data.GetSettingString(mdb.SettingKeyEpayDefaultToken, "")
+		}
+		network := strings.TrimSpace(getString(params, "network"))
+		if network == "" {
+			network = data.GetSettingString(mdb.SettingKeyEpayDefaultNetwork, "")
+		}
+		currency := strings.TrimSpace(getString(params, "currency"))
+		if currency == "" {
+			currency = data.GetSettingString(mdb.SettingKeyEpayDefaultCurrency, "")
+		}
+		if currency == "" {
+			currency = "cny"
+		}
 
 		amountFloat, err := strconv.ParseFloat(money, 64)
 		if err != nil {
-			return comm.Ctrl.FailJson(ctx, fmt.Errorf("invalid money value: %s", money))
+			return comm.Ctrl.FailJson(ctx, constant.PayAmountErr)
 		}
 
 		body := map[string]interface{}{
-			"token":        data.GetSettingString(mdb.SettingKeyEpayDefaultToken, "usdt"),
+			"token":        token,
-			"currency":     data.GetSettingString(mdb.SettingKeyEpayDefaultCurrency, "cny"),
+			"currency":     currency,
-			"network":      data.GetSettingString(mdb.SettingKeyEpayDefaultNetwork, "tron"),
+			"network":      network,
 			"amount":       amountFloat,
 			"notify_url":   notifyURL,
 			"order_id":     outTradeNo,
@@ -153,7 +173,7 @@ func RegisterRoute(e *echo.Echo) {
 
 		jsonBytes, err := json.Marshal(body)
 		if err != nil {
-			return comm.Ctrl.FailJson(ctx, err)
+			return comm.Ctrl.FailJson(ctx, constant.SystemErr)
 		}
 
 		ctx.Request().Body = io.NopCloser(bytes.NewBuffer(jsonBytes))
@@ -268,6 +288,7 @@ func registerAdminRoutes(e *echo.Echo) {
 	authed.GET("/dashboard/asset-trend", admin.Ctrl.AssetTrend)
 	authed.GET("/dashboard/revenue-trend", admin.Ctrl.RevenueTrend)
 	authed.GET("/dashboard/order-stats", admin.Ctrl.OrderStats)
+	authed.GET("/dashboard/rpc-stats", admin.Ctrl.RpcStats)
 	authed.GET("/dashboard/recent-orders", admin.Ctrl.RecentOrders)
 
 	// Settings

src/task/listen.go

@@ -14,6 +14,7 @@ func Start() {
 	go StartPolygonWebSocketListener()
 	go StartPlasmaWebSocketListener()
 	go StartTronBlockScannerListener()
+	go StartTonBlockScannerListener()
 
 	c := cron.New()
 

src/task/listen_bsc.go

@@ -66,18 +66,18 @@ func runBscListener(contracts []common.Address) {
 		}
 	}()
 
-	wsURL, ok := resolveChainWsURL(mdb.NetworkBsc, "[BSC-WS]")
+	wsNode, ok := resolveChainWsNode(mdb.NetworkBsc, "[BSC-WS]")
 	if !ok {
 		return
 	}
-	log.Sugar.Infof("[BSC-WS] connecting to %s watching %d contract(s)", wsURL, len(contracts))
+	log.Sugar.Infof("[BSC-WS] connecting using WSS node %s watching %d contract(s)", data.RpcNodeLogLabel(wsNode), len(contracts))
 
 	query := ethereum.FilterQuery{
 		Addresses: contracts,
 		Topics:    [][]common.Hash{},
 	}
 
-	runEvmWsLogListener(ctx, "[BSC-WS]", wsURL, query, func(client *ethclient.Client, vLog types.Log) {
+	runEvmWsLogListener(ctx, mdb.NetworkBsc, "[BSC-WS]", wsNode, query, func(client *ethclient.Client, vLog types.Log) {
 		if len(vLog.Topics) < 3 {
 			return
 		}
@@ -98,9 +98,11 @@ func runBscListener(contracts []common.Address) {
 		var blockTsMs int64
 		header, err := client.HeaderByNumber(context.Background(), big.NewInt(int64(vLog.BlockNumber)))
 		if err != nil {
+			data.RecordRpcFailure(mdb.NetworkBsc)
 			log.Sugar.Warnf("[BSC-WS] HeaderByNumber block=%d: %v, using local time", vLog.BlockNumber, err)
 			blockTsMs = time.Now().UnixMilli()
 		} else {
+			data.RecordRpcSuccess(mdb.NetworkBsc)
 			blockTsMs = int64(header.Time) * 1000
 		}
 

src/task/listen_chain_common.go

@@ -93,19 +93,28 @@ func loadChainTokenContracts(network, logPrefix string) []common.Address {
 // given network. If no enabled node is configured, the caller skips the
 // current listener run so admin-side disabled/deleted rows are respected.
 func resolveChainWsURL(network, logPrefix string) (string, bool) {
-	node, err := data.SelectRpcNode(network, mdb.RpcNodeTypeWs)
+	node, ok := resolveChainWsNode(network, logPrefix)
+	if !ok {
+		return "", false
+	}
+	return strings.TrimSpace(node.Url), true
+}
+
+func resolveChainWsNode(network, logPrefix string, excludeIDs ...uint64) (mdb.RpcNode, bool) {
+	node, err := data.SelectGeneralRpcNode(network, mdb.RpcNodeTypeWs, excludeIDs...)
 	if err == nil && node != nil && node.ID > 0 {
 		rpcURL := strings.TrimSpace(node.Url)
 		if rpcURL != "" {
-			return rpcURL, true
+			node.Url = rpcURL
+			return *node, true
 		}
 		log.Sugar.Errorf("%s rpc_nodes id=%d has empty url", logPrefix, node.ID)
-		return "", false
+		return mdb.RpcNode{}, false
 	}
 	if err != nil {
 		log.Sugar.Errorf("%s resolve rpc_nodes err=%v", logPrefix, err)
 	} else {
 		log.Sugar.Warnf("%s no enabled %s WS RPC node configured in rpc_nodes", logPrefix, network)
 	}
-	return "", false
+	return mdb.RpcNode{}, false
 }

src/task/listen_chain_common_test.go

@@ -1,13 +1,23 @@
 package task
 
 import (
+	"math/big"
 	"testing"
+	"time"
 
 	"github.com/GMWalletApp/epusdt/internal/testutil"
 	"github.com/GMWalletApp/epusdt/model/dao"
+	"github.com/GMWalletApp/epusdt/model/data"
 	"github.com/GMWalletApp/epusdt/model/mdb"
+	epLog "github.com/GMWalletApp/epusdt/util/log"
+	"github.com/ethereum/go-ethereum/core/types"
+	"go.uber.org/zap"
 )
 
+func init() {
+	epLog.Sugar = zap.NewNop().Sugar()
+}
+
 func TestResolveChainWsURLRequiresEnabledRpcNode(t *testing.T) {
 	cleanup := testutil.SetupTestDatabases(t)
 	defer cleanup()
@@ -42,6 +52,143 @@ func TestResolveChainWsURLWithRow(t *testing.T) {
 	}
 }
 
+func TestResolveChainWsURLIgnoresManualVerifyOnly(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+
+	if err := dao.Mdb.Create(&mdb.RpcNode{
+		Network: mdb.NetworkEthereum,
+		Url:     "wss://paid-ethereum.example.com",
+		Type:    mdb.RpcNodeTypeWs,
+		Weight:  100,
+		Enabled: true,
+		Purpose: mdb.RpcNodePurposeManualVerify,
+		Status:  mdb.RpcNodeStatusOk,
+	}).Error; err != nil {
+		t.Fatalf("seed manual rpc_node: %v", err)
+	}
+
+	if got, ok := resolveChainWsURL(mdb.NetworkEthereum, "[TEST]"); ok {
+		t.Fatalf("resolveChainWsURL() = (%q, true), want false", got)
+	}
+}
+
+func TestResolveChainWsURLUsesGeneralWhenManualVerifyExists(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+
+	rows := []mdb.RpcNode{
+		{Network: mdb.NetworkEthereum, Url: "wss://paid-ethereum.example.com", Type: mdb.RpcNodeTypeWs, Weight: 100, Enabled: true, Purpose: mdb.RpcNodePurposeManualVerify, Status: mdb.RpcNodeStatusOk},
+		{Network: mdb.NetworkEthereum, Url: " wss://general-ethereum.example.com ", Type: mdb.RpcNodeTypeWs, Weight: 1, Enabled: true, Purpose: mdb.RpcNodePurposeGeneral, Status: mdb.RpcNodeStatusOk},
+	}
+	if err := dao.Mdb.Create(&rows).Error; err != nil {
+		t.Fatalf("seed rpc_nodes: %v", err)
+	}
+
+	got, ok := resolveChainWsURL(mdb.NetworkEthereum, "[TEST]")
+	if !ok {
+		t.Fatalf("resolveChainWsURL() ok=false, want true")
+	}
+	if got != "wss://general-ethereum.example.com" {
+		t.Fatalf("resolveChainWsURL() = %q, want general node", got)
+	}
+}
+
+func TestResolveChainWsNodeSkipsCoolingNode(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+	data.ResetRpcFailoverForTest()
+	t.Cleanup(data.ResetRpcFailoverForTest)
+
+	rows := []mdb.RpcNode{
+		{Network: mdb.NetworkEthereum, Url: "wss://primary-ethereum.example.com", Type: mdb.RpcNodeTypeWs, Weight: 100, Enabled: true, Purpose: mdb.RpcNodePurposeGeneral, Status: mdb.RpcNodeStatusOk},
+		{Network: mdb.NetworkEthereum, Url: "wss://backup-ethereum.example.com", Type: mdb.RpcNodeTypeWs, Weight: 1, Enabled: true, Purpose: mdb.RpcNodePurposeGeneral, Status: mdb.RpcNodeStatusOk},
+	}
+	if err := dao.Mdb.Create(&rows).Error; err != nil {
+		t.Fatalf("seed rpc_nodes: %v", err)
+	}
+
+	primary, ok := resolveChainWsNode(mdb.NetworkEthereum, "[TEST]")
+	if !ok || primary.Url != "wss://primary-ethereum.example.com" {
+		t.Fatalf("primary node = %#v ok=%v, want primary", primary, ok)
+	}
+	for i := 0; i < data.RpcFailoverThreshold; i++ {
+		data.RecordRpcNodeFailure(primary.ID)
+	}
+
+	got, ok := resolveChainWsNode(mdb.NetworkEthereum, "[TEST]")
+	if !ok {
+		t.Fatalf("resolveChainWsNode() ok=false, want true")
+	}
+	if got.Url != "wss://backup-ethereum.example.com" {
+		t.Fatalf("resolveChainWsNode() = %#v, want backup", got)
+	}
+}
+
+func TestEvmWsNodeFailureRecordsRuntimeStats(t *testing.T) {
+	data.ResetRpcFailoverForTest()
+	data.ResetRpcRuntimeStatsForTest()
+	t.Cleanup(data.ResetRpcFailoverForTest)
+	t.Cleanup(data.ResetRpcRuntimeStatsForTest)
+
+	recordEvmWsNodeFailure("[TEST]", mdb.NetworkEthereum, mdb.RpcNode{
+		BaseModel: mdb.BaseModel{ID: 123},
+		Url:       "wss://ethereum.example.com",
+		Type:      mdb.RpcNodeTypeWs,
+	}, "dial")
+
+	stats := data.SnapshotRpcRuntimeStats()
+	eth := stats[mdb.NetworkEthereum]
+	if eth.SuccessCount != 0 {
+		t.Fatalf("ethereum success_count = %d, want 0", eth.SuccessCount)
+	}
+	if eth.FailureCount != 1 {
+		t.Fatalf("ethereum failure_count = %d, want 1", eth.FailureCount)
+	}
+}
+
+func TestEvmLogBlockHeightRecordsRuntimeHeight(t *testing.T) {
+	data.ResetRpcRuntimeStatsForTest()
+	t.Cleanup(data.ResetRpcRuntimeStatsForTest)
+
+	recordEvmLogBlockHeight(mdb.NetworkEthereum, "[TEST]", 123456)
+	recordEvmLogBlockHeight(mdb.NetworkEthereum, "[TEST]", 123455)
+
+	stats := data.SnapshotRpcRuntimeStats()
+	eth := stats[mdb.NetworkEthereum]
+	if eth.LatestBlockHeight != 123456 {
+		t.Fatalf("ethereum latest_block_height = %d, want 123456", eth.LatestBlockHeight)
+	}
+}
+
+func TestEvmHeaderBlockHeightRecordsRuntimeHeight(t *testing.T) {
+	data.ResetRpcRuntimeStatsForTest()
+	t.Cleanup(data.ResetRpcRuntimeStatsForTest)
+
+	recordEvmHeaderBlockHeight(mdb.NetworkPolygon, "[TEST]", &types.Header{Number: big.NewInt(7654321)})
+	recordEvmHeaderBlockHeight(mdb.NetworkPolygon, "[TEST]", &types.Header{Number: big.NewInt(7654320)})
+
+	stats := data.SnapshotRpcRuntimeStats()
+	polygon := stats[mdb.NetworkPolygon]
+	if polygon.LatestBlockHeight != 7654321 {
+		t.Fatalf("polygon latest_block_height = %d, want 7654321", polygon.LatestBlockHeight)
+	}
+}
+
+func TestShouldRefreshEvmLatestHeaderAfterIdleInterval(t *testing.T) {
+	lastUpdate := time.Now()
+
+	if shouldRefreshEvmLatestHeader(lastUpdate, false, lastUpdate.Add(evmStatsIdleInterval-time.Second)) {
+		t.Fatal("should not refresh latest header before idle interval")
+	}
+	if !shouldRefreshEvmLatestHeader(lastUpdate, false, lastUpdate.Add(evmStatsIdleInterval)) {
+		t.Fatal("should refresh latest header at idle interval")
+	}
+	if shouldRefreshEvmLatestHeader(lastUpdate, true, lastUpdate.Add(evmStatsIdleInterval+time.Second)) {
+		t.Fatal("should not refresh latest header while request is in flight")
+	}
+}
+
 func TestResolveChainWsURLDisabledRow(t *testing.T) {
 	cleanup := testutil.SetupTestDatabases(t)
 	defer cleanup()

src/task/listen_eth.go

@@ -71,18 +71,18 @@ func runEthereumListener(contracts []common.Address) {
 		}
 	}()
 
-	wsURL, ok := resolveChainWsURL(mdb.NetworkEthereum, "[ETH-WS]")
+	wsNode, ok := resolveChainWsNode(mdb.NetworkEthereum, "[ETH-WS]")
 	if !ok {
 		return
 	}
-	log.Sugar.Infof("[ETH-WS] connecting to %s watching %d contract(s)", wsURL, len(contracts))
+	log.Sugar.Infof("[ETH-WS] connecting using WSS node %s watching %d contract(s)", data.RpcNodeLogLabel(wsNode), len(contracts))
 
 	query := ethereum.FilterQuery{
 		Addresses: contracts,
 		Topics:    [][]common.Hash{},
 	}
 
-	runEvmWsLogListener(ctx, "[ETH-WS]", wsURL, query, func(client *ethclient.Client, vLog types.Log) {
+	runEvmWsLogListener(ctx, mdb.NetworkEthereum, "[ETH-WS]", wsNode, query, func(client *ethclient.Client, vLog types.Log) {
 		if len(vLog.Topics) < 3 {
 			return
 		}
@@ -100,9 +100,11 @@ func runEthereumListener(contracts []common.Address) {
 		var blockTsMs int64
 		header, err := client.HeaderByNumber(context.Background(), big.NewInt(int64(vLog.BlockNumber)))
 		if err != nil {
+			data.RecordRpcFailure(mdb.NetworkEthereum)
 			log.Sugar.Warnf("[ETH-WS] HeaderByNumber block=%d: %v, using local time", vLog.BlockNumber, err)
 			blockTsMs = time.Now().UnixMilli()
 		} else {
+			data.RecordRpcSuccess(mdb.NetworkEthereum)
 			blockTsMs = int64(header.Time) * 1000
 		}
 

src/task/listen_evm_ws.go

@@ -2,8 +2,11 @@ package task
 
 import (
 	"context"
+	"fmt"
 	"time"
 
+	"github.com/GMWalletApp/epusdt/model/data"
+	"github.com/GMWalletApp/epusdt/model/mdb"
 	"github.com/GMWalletApp/epusdt/util/log"
 
 	"github.com/ethereum/go-ethereum"
@@ -11,18 +14,26 @@ import (
 	"github.com/ethereum/go-ethereum/ethclient"
 )
 
-// runEvmWsLogListener connects to wsURL, subscribes to Transfer logs,
+const (
+	evmStatsIdleInterval  = 30 * time.Second
+	evmStatsHeaderTimeout = 10 * time.Second
+)
+
+// runEvmWsLogListener connects to node.Url, subscribes to Transfer logs,
 // and dispatches each log to handleLog. It retries on transient errors
-// with exponential backoff. The ctx lets the caller trigger a clean
+// with exponential backoff until the node reaches the failure threshold.
-// exit — e.g. when admin disables the chain, the caller cancels the
+// The ctx lets the caller trigger a clean exit — e.g. when admin disables
-// context and the function returns instead of reconnecting forever.
+// the chain, the caller cancels the context and the function returns.
-func runEvmWsLogListener(ctx context.Context, logPrefix, wsURL string, query ethereum.FilterQuery, handleLog func(*ethclient.Client, types.Log)) {
+func runEvmWsLogListener(ctx context.Context, network string, logPrefix string, node mdb.RpcNode, query ethereum.FilterQuery, handleLog func(*ethclient.Client, types.Log)) {
 	const (
 		minBackoff       = 2 * time.Second
 		maxBackoff       = 60 * time.Second
 		rejoinWait       = 3 * time.Second
+		stableResetAfter = 60 * time.Second
 	)
 	failWait := minBackoff
+	wsURL := node.Url
+	nodeLabel := data.RpcNodeLogLabel(node)
 
 	for {
 		if ctx.Err() != nil {
@@ -31,7 +42,13 @@ func runEvmWsLogListener(ctx context.Context, logPrefix, wsURL string, query eth
 
 		client, err := ethclient.Dial(wsURL)
 		if err != nil {
+			if ctx.Err() != nil {
+				return
+			}
 			log.Sugar.Warnf("%s dial: %v, retry in %s", logPrefix, err, failWait)
+			if recordEvmWsNodeFailure(logPrefix, network, node, "dial") {
+				return
+			}
 			if !sleepOrDone(ctx, failWait) {
 				return
 			}
@@ -43,7 +60,13 @@ func runEvmWsLogListener(ctx context.Context, logPrefix, wsURL string, query eth
 		sub, err := client.SubscribeFilterLogs(ctx, query, logsCh)
 		if err != nil {
 			client.Close()
+			if ctx.Err() != nil {
+				return
+			}
 			log.Sugar.Warnf("%s subscribe: %v, retry in %s", logPrefix, err, failWait)
+			if recordEvmWsNodeFailure(logPrefix, network, node, "subscribe") {
+				return
+			}
 			if !sleepOrDone(ctx, failWait) {
 				return
 			}
@@ -51,22 +74,49 @@ func runEvmWsLogListener(ctx context.Context, logPrefix, wsURL string, query eth
 			continue
 		}
 		failWait = minBackoff
+		data.RecordRpcSuccess(network)
 
-		log.Sugar.Infof("%s connected, subscribed to Transfer logs", logPrefix)
+		log.Sugar.Infof("%s connected, subscribed to Transfer logs using WSS node %s", logPrefix, nodeLabel)
 
-		recvLoop(ctx, client, sub, logsCh, logPrefix, handleLog)
+		connectedAt := time.Now()
+		recvErr := recvLoop(ctx, client, sub, logsCh, network, logPrefix, handleLog)
 
 		if ctx.Err() != nil {
 			return
 		}
+		if time.Since(connectedAt) >= stableResetAfter {
+			if recvErr != nil {
+				data.RecordRpcFailure(network)
+			}
+			data.RecordRpcNodeSuccess(node.ID)
+		} else if recvErr != nil && recordEvmWsNodeFailure(logPrefix, network, node, recvErr.Error()) {
+			return
+		}
 		if !sleepOrDone(ctx, rejoinWait) {
 			return
 		}
 	}
 }
 
-func recvLoop(ctx context.Context, client *ethclient.Client, sub ethereum.Subscription, logsCh <-chan types.Log, logPrefix string, handleLog func(*ethclient.Client, types.Log)) {
+func recvLoop(ctx context.Context, client *ethclient.Client, sub ethereum.Subscription, logsCh <-chan types.Log, network string, logPrefix string, handleLog func(*ethclient.Client, types.Log)) error {
+	statsCtx, cancelStats := context.WithCancel(ctx)
+	statsTicker := time.NewTicker(evmStatsIdleInterval)
+	headerStatsDone := make(chan bool, 1)
+	lastStatsUpdateAt := time.Now()
+	headerStatsInFlight := false
+	requestLatestHeader := func() {
+		if headerStatsInFlight {
+			return
+		}
+		headerStatsInFlight = true
+		go func() {
+			headerStatsDone <- recordEvmLatestHeader(statsCtx, network, logPrefix, client)
+		}()
+	}
+
 	defer func() {
+		cancelStats()
+		statsTicker.Stop()
 		sub.Unsubscribe()
 		client.Close()
 	}()
@@ -75,24 +125,94 @@ func recvLoop(ctx context.Context, client *ethclient.Client, sub ethereum.Subscr
 		select {
 		case <-ctx.Done():
 			log.Sugar.Infof("%s context cancelled, stopping", logPrefix)
-			return
+			return nil
+		case <-statsTicker.C:
+			if shouldRefreshEvmLatestHeader(lastStatsUpdateAt, headerStatsInFlight, time.Now()) {
+				requestLatestHeader()
+			}
+		case updated := <-headerStatsDone:
+			headerStatsInFlight = false
+			if updated {
+				lastStatsUpdateAt = time.Now()
+			}
 		case err := <-sub.Err():
 			if err != nil {
 				log.Sugar.Warnf("%s subscription error: %v, reconnecting", logPrefix, err)
+				return fmt.Errorf("subscription error")
 			} else {
 				log.Sugar.Warnf("%s subscription closed, reconnecting", logPrefix)
+				return fmt.Errorf("subscription closed")
 			}
-			return
 		case vLog, ok := <-logsCh:
 			if !ok {
 				log.Sugar.Warnf("%s log channel closed, reconnecting", logPrefix)
-				return
+				return fmt.Errorf("log channel closed")
+			}
+			if recordEvmLogBlockHeight(network, logPrefix, vLog.BlockNumber) {
+				lastStatsUpdateAt = time.Now()
 			}
 			handleLog(client, vLog)
 		}
 	}
 }
 
+func shouldRefreshEvmLatestHeader(lastStatsUpdateAt time.Time, inFlight bool, now time.Time) bool {
+	return !inFlight && now.Sub(lastStatsUpdateAt) >= evmStatsIdleInterval
+}
+
+func recordEvmLogBlockHeight(network string, logPrefix string, blockNumber uint64) bool {
+	if blockNumber == 0 {
+		return false
+	}
+	if blockNumber > uint64(1<<63-1) {
+		log.Sugar.Warnf("%s log block number exceeds int64 range: %d", logPrefix, blockNumber)
+		return false
+	}
+	data.RecordRpcBlockHeight(network, int64(blockNumber))
+	return true
+}
+
+func recordEvmLatestHeader(ctx context.Context, network string, logPrefix string, client *ethclient.Client) bool {
+	headerCtx, cancel := context.WithTimeout(ctx, evmStatsHeaderTimeout)
+	defer cancel()
+
+	header, err := client.HeaderByNumber(headerCtx, nil)
+	if err != nil {
+		if ctx.Err() != nil {
+			return false
+		}
+		data.RecordRpcFailure(network)
+		log.Sugar.Warnf("%s latest header stats failed: %v", logPrefix, err)
+		return false
+	}
+	data.RecordRpcSuccess(network)
+	return recordEvmHeaderBlockHeight(network, logPrefix, header)
+}
+
+func recordEvmHeaderBlockHeight(network string, logPrefix string, header *types.Header) bool {
+	if header == nil || header.Number == nil {
+		return false
+	}
+	if !header.Number.IsInt64() {
+		log.Sugar.Warnf("%s latest header block number exceeds int64 range: %s", logPrefix, header.Number.String())
+		return false
+	}
+	data.RecordRpcBlockHeight(network, header.Number.Int64())
+	return true
+}
+
+func recordEvmWsNodeFailure(logPrefix string, network string, node mdb.RpcNode, reason string) bool {
+	data.RecordRpcFailure(network)
+	failures, cooling := data.RecordRpcNodeFailure(node.ID)
+	nodeLabel := data.RpcNodeLogLabel(node)
+	if !cooling {
+		log.Sugar.Warnf("%s WSS node failed (%s), node=%s failures=%d/%d", logPrefix, reason, nodeLabel, failures, data.RpcFailoverThreshold)
+		return false
+	}
+	log.Sugar.Warnf("%s WSS node reached fail threshold (%s), node=%s, resolving another node", logPrefix, reason, nodeLabel)
+	return true
+}
+
 // sleepOrDone waits for d or for ctx cancellation, whichever comes
 // first. Returns true if the sleep completed normally, false if ctx
 // was cancelled (caller should exit).

src/task/listen_plasma.go

@@ -65,18 +65,18 @@ func runPlasmaListener(contracts []common.Address) {
 		}
 	}()
 
-	wsURL, ok := resolveChainWsURL(mdb.NetworkPlasma, "[PLASMA-WS]")
+	wsNode, ok := resolveChainWsNode(mdb.NetworkPlasma, "[PLASMA-WS]")
 	if !ok {
 		return
 	}
-	log.Sugar.Infof("[PLASMA-WS] connecting to %s watching %d contract(s)", wsURL, len(contracts))
+	log.Sugar.Infof("[PLASMA-WS] connecting using WSS node %s watching %d contract(s)", data.RpcNodeLogLabel(wsNode), len(contracts))
 
 	query := ethereum.FilterQuery{
 		Addresses: contracts,
 		Topics:    [][]common.Hash{},
 	}
 
-	runEvmWsLogListener(ctx, "[PLASMA-WS]", wsURL, query, func(client *ethclient.Client, vLog types.Log) {
+	runEvmWsLogListener(ctx, mdb.NetworkPlasma, "[PLASMA-WS]", wsNode, query, func(client *ethclient.Client, vLog types.Log) {
 		if len(vLog.Topics) < 3 {
 			return
 		}
@@ -97,9 +97,11 @@ func runPlasmaListener(contracts []common.Address) {
 		var blockTsMs int64
 		header, err := client.HeaderByNumber(context.Background(), big.NewInt(int64(vLog.BlockNumber)))
 		if err != nil {
+			data.RecordRpcFailure(mdb.NetworkPlasma)
 			log.Sugar.Warnf("[PLASMA-WS] HeaderByNumber block=%d: %v, using local time", vLog.BlockNumber, err)
 			blockTsMs = time.Now().UnixMilli()
 		} else {
+			data.RecordRpcSuccess(mdb.NetworkPlasma)
 			blockTsMs = int64(header.Time) * 1000
 		}
 

src/task/listen_polygon.go

@@ -65,18 +65,18 @@ func runPolygonListener(contracts []common.Address) {
 		}
 	}()
 
-	wsURL, ok := resolveChainWsURL(mdb.NetworkPolygon, "[POLYGON-WS]")
+	wsNode, ok := resolveChainWsNode(mdb.NetworkPolygon, "[POLYGON-WS]")
 	if !ok {
 		return
 	}
-	log.Sugar.Infof("[POLYGON-WS] connecting to %s watching %d contract(s)", wsURL, len(contracts))
+	log.Sugar.Infof("[POLYGON-WS] connecting using WSS node %s watching %d contract(s)", data.RpcNodeLogLabel(wsNode), len(contracts))
 
 	query := ethereum.FilterQuery{
 		Addresses: contracts,
 		Topics:    [][]common.Hash{},
 	}
 
-	runEvmWsLogListener(ctx, "[POLYGON-WS]", wsURL, query, func(client *ethclient.Client, vLog types.Log) {
+	runEvmWsLogListener(ctx, mdb.NetworkPolygon, "[POLYGON-WS]", wsNode, query, func(client *ethclient.Client, vLog types.Log) {
 		if len(vLog.Topics) < 3 {
 			return
 		}
@@ -97,9 +97,11 @@ func runPolygonListener(contracts []common.Address) {
 		var blockTsMs int64
 		header, err := client.HeaderByNumber(context.Background(), big.NewInt(int64(vLog.BlockNumber)))
 		if err != nil {
+			data.RecordRpcFailure(mdb.NetworkPolygon)
 			log.Sugar.Warnf("[POLYGON-WS] HeaderByNumber block=%d: %v, using local time", vLog.BlockNumber, err)
 			blockTsMs = time.Now().UnixMilli()
 		} else {
+			data.RecordRpcSuccess(mdb.NetworkPolygon)
 			blockTsMs = int64(header.Time) * 1000
 		}
 

src/task/listen_sol_job.go

@@ -12,15 +12,21 @@ import (
 type ListenSolJob struct{}
 
 var gListenSolJobLock sync.Mutex
+var gSolanaBlockHeightLock = make(chan struct{}, 1)
 
 func (r ListenSolJob) Run() {
+	shouldRecordHeight := false
+	func() {
 		gListenSolJobLock.Lock()
 		defer gListenSolJobLock.Unlock()
+
 		log.Sugar.Debug("[ListenSolJob] Job triggered")
 		if !data.IsChainEnabled(mdb.NetworkSolana) {
 			log.Sugar.Debug("[ListenSolJob] chain disabled, skipping")
 			return
 		}
+		shouldRecordHeight = true
+
 		walletAddress, err := data.GetAvailableWalletAddressByNetwork(mdb.NetworkSolana)
 		if err != nil {
 			log.Sugar.Errorf("[ListenSolJob] Failed to get wallet addresses: %v", err)
@@ -39,4 +45,26 @@ func (r ListenSolJob) Run() {
 		}
 		wg.Wait()
 		log.Sugar.Debug("[ListenSolJob] Job completed")
+	}()
+
+	if shouldRecordHeight {
+		recordSolanaLatestBlockHeight()
+	}
+}
+
+func recordSolanaLatestBlockHeight() {
+	select {
+	case gSolanaBlockHeightLock <- struct{}{}:
+		defer func() { <-gSolanaBlockHeightLock }()
+	default:
+		log.Sugar.Debug("[ListenSolJob] previous Solana block height stats still running, skipping")
+		return
+	}
+
+	height, err := service.SolGetBlockHeight()
+	if err != nil {
+		log.Sugar.Warnf("[ListenSolJob] get Solana block height failed: %v", err)
+	} else {
+		data.RecordRpcBlockHeight(mdb.NetworkSolana, height)
+	}
 }

src/task/listen_sol_job_test.go

@@ -0,0 +1,124 @@
+package task
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/GMWalletApp/epusdt/internal/testutil"
+	"github.com/GMWalletApp/epusdt/model/dao"
+	"github.com/GMWalletApp/epusdt/model/data"
+	"github.com/GMWalletApp/epusdt/model/mdb"
+)
+
+func TestListenSolJobRecordsRuntimeBlockHeight(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+	data.ResetRpcRuntimeStatsForTest()
+	t.Cleanup(data.ResetRpcRuntimeStatsForTest)
+
+	methodCalls := make(map[string]int)
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		var req struct {
+			Method string `json:"method"`
+		}
+		_ = json.NewDecoder(r.Body).Decode(&req)
+		methodCalls[req.Method]++
+
+		w.Header().Set("Content-Type", "application/json")
+		if req.Method == "getBlockHeight" {
+			_ = json.NewEncoder(w).Encode(map[string]interface{}{
+				"jsonrpc": "2.0",
+				"id":      1,
+				"result":  int64(654321),
+			})
+			return
+		}
+
+		_ = json.NewEncoder(w).Encode(map[string]interface{}{
+			"jsonrpc": "2.0",
+			"id":      1,
+			"result": []map[string]interface{}{
+				{
+					"signature": "solana-test-signature",
+					"slot":      uint64(123456),
+					"err": map[string]interface{}{
+						"InstructionError": []interface{}{0, "Custom"},
+					},
+					"blockTime": nil,
+				},
+			},
+		})
+	}))
+	defer server.Close()
+
+	if err := dao.Mdb.Create(&mdb.RpcNode{
+		Network: mdb.NetworkSolana,
+		Url:     server.URL,
+		Type:    mdb.RpcNodeTypeHttp,
+		Weight:  1,
+		Enabled: true,
+		Purpose: mdb.RpcNodePurposeGeneral,
+		Status:  mdb.RpcNodeStatusOk,
+	}).Error; err != nil {
+		t.Fatalf("seed solana rpc_node: %v", err)
+	}
+	if err := dao.Mdb.Create(&mdb.WalletAddress{
+		Network: mdb.NetworkSolana,
+		Address: "SolTestAddress001",
+		Status:  mdb.TokenStatusEnable,
+	}).Error; err != nil {
+		t.Fatalf("seed solana wallet: %v", err)
+	}
+	if err := dao.Mdb.Create(&mdb.ChainToken{
+		Network:         mdb.NetworkSolana,
+		Symbol:          "SOL",
+		ContractAddress: "",
+		Decimals:        9,
+		Enabled:         true,
+	}).Error; err != nil {
+		t.Fatalf("seed solana chain_token: %v", err)
+	}
+
+	ListenSolJob{}.Run()
+
+	if methodCalls["getSignaturesForAddress"] != 1 {
+		t.Fatalf("getSignaturesForAddress calls = %d, want 1", methodCalls["getSignaturesForAddress"])
+	}
+	if methodCalls["getBlockHeight"] != 1 {
+		t.Fatalf("getBlockHeight calls = %d, want 1", methodCalls["getBlockHeight"])
+	}
+
+	stats := data.SnapshotRpcRuntimeStats()
+	solana := stats[mdb.NetworkSolana]
+	if solana.SuccessCount != 2 {
+		t.Fatalf("solana success_count = %d, want 2", solana.SuccessCount)
+	}
+	if solana.FailureCount != 0 {
+		t.Fatalf("solana failure_count = %d, want 0", solana.FailureCount)
+	}
+	if solana.LatestBlockHeight != 654321 {
+		t.Fatalf("solana latest_block_height = %d, want 654321", solana.LatestBlockHeight)
+	}
+	if solana.LastSyncAt.IsZero() {
+		t.Fatal("solana last_sync_at is zero")
+	}
+}
+
+func TestRecordSolanaLatestBlockHeightSkipsWhenPreviousStatsRunning(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+	data.ResetRpcRuntimeStatsForTest()
+	t.Cleanup(data.ResetRpcRuntimeStatsForTest)
+
+	gSolanaBlockHeightLock <- struct{}{}
+	defer func() { <-gSolanaBlockHeightLock }()
+
+	recordSolanaLatestBlockHeight()
+
+	stats := data.SnapshotRpcRuntimeStats()
+	if _, ok := stats[mdb.NetworkSolana]; ok {
+		t.Fatalf("solana stats = %#v, want no stats when height reporter is already running", stats[mdb.NetworkSolana])
+	}
+}

src/task/listen_ton.go

@@ -0,0 +1,574 @@
+package task
+
+import (
+	"context"
+	"encoding/hex"
+	"fmt"
+	"sort"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/GMWalletApp/epusdt/model/data"
+	"github.com/GMWalletApp/epusdt/model/mdb"
+	"github.com/GMWalletApp/epusdt/model/service"
+	addressutil "github.com/GMWalletApp/epusdt/util/address"
+	"github.com/GMWalletApp/epusdt/util/log"
+	"github.com/xssnick/tonutils-go/address"
+	"github.com/xssnick/tonutils-go/ton"
+	"github.com/xssnick/tonutils-go/ton/jetton"
+)
+
+const (
+	tonMasterShard           = int64(-0x8000000000000000)
+	tonScannerConnectTimeout = 20 * time.Second
+	tonScannerRequestTimeout = 15 * time.Second
+	tonScannerRetryDelay     = 3 * time.Second
+	tonCatchupYield          = 250 * time.Millisecond
+	tonMaxMasterBlocksTick   = uint32(50)
+	tonBlockTxPageSize       = uint32(256)
+)
+
+type tonWatchState struct {
+	wallets      map[string]*address.Address
+	nativeToken  *mdb.ChainToken
+	jettonTokens []mdb.ChainToken
+}
+
+func (s *tonWatchState) hasWalletInWorkchain(workchain int32) bool {
+	if s == nil {
+		return false
+	}
+	for _, wallet := range s.wallets {
+		if wallet != nil && wallet.Workchain() == workchain {
+			return true
+		}
+	}
+	return false
+}
+
+type tonRuntimeCursor struct {
+	initialized     bool
+	lastMasterSeqNo uint32
+	shardSeqNo      map[string]uint32
+}
+
+func (c *tonRuntimeCursor) ensureShardSeqNo() {
+	if c.shardSeqNo == nil {
+		c.shardSeqNo = make(map[string]uint32)
+	}
+}
+
+type tonJettonWalletCache struct {
+	sync.Mutex
+	walletByOwnerToken map[string]string
+}
+
+func newTonJettonWalletCache() *tonJettonWalletCache {
+	return &tonJettonWalletCache{walletByOwnerToken: make(map[string]string)}
+}
+
+// StartTonBlockScannerListener runs a forward-only TON masterchain scanner.
+func StartTonBlockScannerListener() {
+	cache := newTonJettonWalletCache()
+	cursor := &tonRuntimeCursor{}
+	for {
+		chain, interval := tonChainConfig()
+		if chain == nil || !chain.Enabled {
+			sleepOrDone(context.Background(), interval)
+			continue
+		}
+		node, ok := resolveTonLiteNode()
+		if !ok {
+			sleepOrDone(context.Background(), interval)
+			continue
+		}
+		log.Sugar.Infof("[TON] connecting using lite node %s", data.RpcNodeLogLabel(node))
+		api, closeFn, err := connectTonLiteAPI(node)
+		if err != nil {
+			log.Sugar.Warnf("[TON] connect lite node %s failed: %v", data.RpcNodeLogLabel(node), err)
+			recordTonLiteNodeFailure(node, "connect")
+			sleepOrDone(context.Background(), tonScannerRetryDelay)
+			continue
+		}
+		log.Sugar.Infof("[TON] connected using lite node %s", data.RpcNodeLogLabel(node))
+		err = runTonScanner(context.Background(), api, cache, cursor)
+		closeFn()
+		if err != nil {
+			log.Sugar.Warnf("[TON] scanner stopped: %v", err)
+			recordTonLiteNodeFailure(node, err.Error())
+			sleepOrDone(context.Background(), tonScannerRetryDelay)
+			continue
+		}
+	}
+}
+
+func runTonScanner(ctx context.Context, api ton.APIClientWrapped, cache *tonJettonWalletCache, cursor *tonRuntimeCursor) error {
+	if cursor == nil {
+		cursor = &tonRuntimeCursor{}
+	}
+	watchSignature := ""
+	for {
+		chain, interval := tonChainConfig()
+		if chain == nil || !chain.Enabled {
+			return nil
+		}
+		state, err := loadTonWatchState()
+		if err != nil {
+			return err
+		}
+		if len(state.wallets) == 0 || (state.nativeToken == nil && len(state.jettonTokens) == 0) {
+			log.Sugar.Debug("[TON] no enabled wallets or tokens, idling")
+			if !sleepOrDone(ctx, interval) {
+				return nil
+			}
+			continue
+		}
+		if sig := tonWatchStateSignature(state); sig != watchSignature {
+			watchSignature = sig
+			log.Sugar.Infof(
+				"[TON] watching wallets=%d native_ton=%t jetton_tokens=%d wallet_workchains=%s",
+				len(state.wallets),
+				state.nativeToken != nil,
+				len(state.jettonTokens),
+				tonWalletWorkchainSummary(state),
+			)
+		}
+
+		head, err := api.CurrentMasterchainInfo(ctx)
+		if err != nil {
+			data.RecordRpcFailure(mdb.NetworkTon)
+			return fmt.Errorf("current masterchain info: %w", err)
+		}
+		confirmedHeadSeqNo := tonConfirmedMasterSeqNo(head.SeqNo, chain.MinConfirmations)
+		data.RecordRpcSuccess(mdb.NetworkTon)
+		data.RecordRpcBlockHeight(mdb.NetworkTon, int64(head.SeqNo))
+
+		if !cursor.initialized {
+			if err = initializeTonRuntimeCursor(ctx, api, head, confirmedHeadSeqNo, cursor); err != nil {
+				data.RecordRpcFailure(mdb.NetworkTon)
+				return err
+			}
+			log.Sugar.Infof(
+				"[TON] current masterchain head=%d confirmed=%d root=%s file=%s",
+				head.SeqNo,
+				confirmedHeadSeqNo,
+				shortTonHash(head.RootHash),
+				shortTonHash(head.FileHash),
+			)
+			log.Sugar.Infof("[TON] initialized runtime cursor at masterchain seqno=%d head=%d", cursor.lastMasterSeqNo, head.SeqNo)
+			if !sleepOrDone(ctx, interval) {
+				return nil
+			}
+			continue
+		}
+		if cursor.lastMasterSeqNo >= confirmedHeadSeqNo {
+			if !sleepOrDone(ctx, interval) {
+				return nil
+			}
+			continue
+		}
+
+		target := cursor.lastMasterSeqNo + tonMaxMasterBlocksTick
+		if target > confirmedHeadSeqNo {
+			target = confirmedHeadSeqNo
+		}
+		log.Sugar.Infof("[TON] processing masterchain blocks from=%d to=%d head=%d confirmed=%d", cursor.lastMasterSeqNo+1, target, head.SeqNo, confirmedHeadSeqNo)
+		for seq := cursor.lastMasterSeqNo + 1; seq <= target; seq++ {
+			master, err := api.WaitForBlock(seq).LookupBlock(ctx, address.MasterchainID, tonMasterShard, seq)
+			if err != nil {
+				data.RecordRpcFailure(mdb.NetworkTon)
+				return fmt.Errorf("lookup masterchain seqno=%d: %w", seq, err)
+			}
+			if err = processTonMasterBlockWithCursor(ctx, api, master, state, cache, cursor); err != nil {
+				data.RecordRpcFailure(mdb.NetworkTon)
+				return fmt.Errorf("process masterchain seqno=%d: %w", seq, err)
+			}
+			cursor.lastMasterSeqNo = master.SeqNo
+			data.RecordRpcSuccess(mdb.NetworkTon)
+			data.RecordRpcBlockHeight(mdb.NetworkTon, int64(seq))
+		}
+		if target < confirmedHeadSeqNo {
+			if !sleepOrDone(ctx, tonCatchupYield) {
+				return nil
+			}
+		}
+	}
+}
+
+func tonConfirmedMasterSeqNo(headSeqNo uint32, minConfirmations int) uint32 {
+	if minConfirmations <= 1 {
+		return headSeqNo
+	}
+	conf := uint32(minConfirmations)
+	if headSeqNo < conf-1 {
+		return 0
+	}
+	return headSeqNo - conf + 1
+}
+
+func initializeTonRuntimeCursor(ctx context.Context, api ton.APIClientWrapped, head *ton.BlockIDExt, confirmedHeadSeqNo uint32, cursor *tonRuntimeCursor) error {
+	if cursor == nil {
+		return nil
+	}
+	if head == nil {
+		return fmt.Errorf("current masterchain head is nil")
+	}
+	initMaster := head
+	if confirmedHeadSeqNo > 0 && confirmedHeadSeqNo != head.SeqNo {
+		var err error
+		initMaster, err = api.WaitForBlock(confirmedHeadSeqNo).LookupBlock(ctx, address.MasterchainID, tonMasterShard, confirmedHeadSeqNo)
+		if err != nil {
+			return fmt.Errorf("lookup initial confirmed masterchain seqno=%d: %w", confirmedHeadSeqNo, err)
+		}
+	}
+	if confirmedHeadSeqNo > 0 {
+		if err := initializeTonShardCursors(ctx, api, initMaster, cursor); err != nil {
+			return fmt.Errorf("initialize shard cursors masterchain seqno=%d: %w", initMaster.SeqNo, err)
+		}
+	}
+	cursor.initialized = true
+	cursor.lastMasterSeqNo = confirmedHeadSeqNo
+	return nil
+}
+
+func processTonMasterBlock(ctx context.Context, api ton.APIClientWrapped, master *ton.BlockIDExt, state *tonWatchState, cache *tonJettonWalletCache) error {
+	return processTonMasterBlockWithCursor(ctx, api, master, state, cache, nil)
+}
+
+func processTonMasterBlockWithCursor(ctx context.Context, api ton.APIClientWrapped, master *ton.BlockIDExt, state *tonWatchState, cache *tonJettonWalletCache, cursor *tonRuntimeCursor) error {
+	if state.hasWalletInWorkchain(address.MasterchainID) {
+		if err := processTonShardBlock(ctx, api, master, master, state, cache); err != nil {
+			return fmt.Errorf("process masterchain transactions: %w", err)
+		}
+	}
+	shards, err := api.WaitForBlock(master.SeqNo).GetBlockShardsInfo(ctx, master)
+	if err != nil {
+		return err
+	}
+	log.Sugar.Debugf(
+		"[TON] masterchain seqno=%d root=%s file=%s shard_blocks=%d workchains=%s",
+		master.SeqNo,
+		shortTonHash(master.RootHash),
+		shortTonHash(master.FileHash),
+		len(shards),
+		tonShardWorkchainSummary(shards),
+	)
+	if cursor != nil {
+		return processTonShardBlocksWithCursor(ctx, api, master, shards, state, cache, cursor)
+	}
+	for _, shard := range shards {
+		if err = processTonShardBlock(ctx, api, master, shard, state, cache); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func initializeTonShardCursors(ctx context.Context, api ton.APIClientWrapped, master *ton.BlockIDExt, cursor *tonRuntimeCursor) error {
+	if cursor == nil || master == nil {
+		return nil
+	}
+	shards, err := api.WaitForBlock(master.SeqNo).GetBlockShardsInfo(ctx, master)
+	if err != nil {
+		return err
+	}
+	cursor.ensureShardSeqNo()
+	for _, shard := range shards {
+		if shard == nil {
+			continue
+		}
+		cursor.shardSeqNo[tonShardCursorKey(shard)] = shard.SeqNo
+	}
+	log.Sugar.Infof(
+		"[TON] initialized shard cursors masterchain seqno=%d shard_blocks=%d workchains=%s",
+		master.SeqNo,
+		len(shards),
+		tonShardWorkchainSummary(shards),
+	)
+	return nil
+}
+
+func processTonShardBlocksWithCursor(ctx context.Context, api ton.APIClientWrapped, master *ton.BlockIDExt, shards []*ton.BlockIDExt, state *tonWatchState, cache *tonJettonWalletCache, cursor *tonRuntimeCursor) error {
+	if cursor == nil {
+		return nil
+	}
+	cursor.ensureShardSeqNo()
+	for _, shard := range shards {
+		if shard == nil {
+			continue
+		}
+		key := tonShardCursorKey(shard)
+		lastSeqNo, ok := cursor.shardSeqNo[key]
+		if !state.hasWalletInWorkchain(shard.Workchain) {
+			cursor.shardSeqNo[key] = shard.SeqNo
+			continue
+		}
+
+		start := shard.SeqNo
+		if ok {
+			if shard.SeqNo <= lastSeqNo {
+				continue
+			}
+			start = lastSeqNo + 1
+		}
+		if shard.SeqNo > start {
+			log.Sugar.Infof(
+				"[TON] processing shard blocks master_seqno=%d workchain=%d shard=%x from=%d to=%d",
+				master.SeqNo,
+				shard.Workchain,
+				uint64(shard.Shard),
+				start,
+				shard.SeqNo,
+			)
+		}
+		for seq := start; seq <= shard.SeqNo; seq++ {
+			shardBlock := shard
+			if seq != shard.SeqNo {
+				var err error
+				shardBlock, err = api.WaitForBlock(master.SeqNo).LookupBlock(ctx, shard.Workchain, shard.Shard, seq)
+				if err != nil {
+					return fmt.Errorf("lookup shard block workchain=%d shard=%x seqno=%d: %w", shard.Workchain, uint64(shard.Shard), seq, err)
+				}
+			}
+			if err := processTonShardBlock(ctx, api, master, shardBlock, state, cache); err != nil {
+				return err
+			}
+			cursor.shardSeqNo[key] = seq
+		}
+	}
+	return nil
+}
+
+func processTonShardBlock(ctx context.Context, api ton.APIClientWrapped, master, shard *ton.BlockIDExt, state *tonWatchState, cache *tonJettonWalletCache) error {
+	log.Sugar.Debugf("[TON] scanning shard master_seqno=%d workchain=%d shard=%d shard_seqno=%d", master.SeqNo, shard.Workchain, shard.Shard, shard.SeqNo)
+	var after *ton.TransactionID3
+	for {
+		shorts, incomplete, err := api.WaitForBlock(master.SeqNo).GetBlockTransactionsV2(ctx, shard, tonBlockTxPageSize, after)
+		if err != nil {
+			return err
+		}
+		for i := range shorts {
+			account := addressutil.TonAddressFromShortAccount(shard.Workchain, shorts[i].Account)
+			if account == nil {
+				continue
+			}
+			receive, ok := state.wallets[addressutil.TonRawAddressObjectKey(account)]
+			if !ok {
+				continue
+			}
+			log.Sugar.Debugf("[TON] watched account tx candidate master_seqno=%d workchain=%d shard=%d lt=%d account=%s", master.SeqNo, shard.Workchain, shard.Shard, shorts[i].LT, addressutil.TonRawAddressObjectKey(account))
+			tx, err := api.WaitForBlock(master.SeqNo).GetTransaction(ctx, shard, account, shorts[i].LT)
+			if err != nil {
+				return err
+			}
+			if tx == nil {
+				return fmt.Errorf("missing full transaction workchain=%d shard=%d seqno=%d lt=%d", shard.Workchain, shard.Shard, shard.SeqNo, shorts[i].LT)
+			}
+			jettonWallets, err := cache.jettonWalletTokens(ctx, api, master, receive, state.jettonTokens)
+			if err != nil {
+				return err
+			}
+			transfer, err := service.ParseTonInboundTransfer(tx, receive, state.nativeToken, jettonWallets)
+			if err != nil {
+				log.Sugar.Warnf("[TON] parse inbound tx lt=%d hash=%s: %v", tx.LT, hex.EncodeToString(tx.Hash), err)
+				continue
+			}
+			if transfer == nil {
+				log.Sugar.Debugf(
+					"[TON] unsupported watched tx master_seqno=%d workchain=%d shard=%d lt=%d hash=%s account=%s",
+					master.SeqNo,
+					shard.Workchain,
+					shard.Shard,
+					tx.LT,
+					hex.EncodeToString(tx.Hash),
+					addressutil.TonRawAddressObjectKey(account),
+				)
+				continue
+			}
+			service.TryProcessTonTransfer(transfer)
+		}
+		if !incomplete {
+			return nil
+		}
+		if len(shorts) == 0 {
+			return fmt.Errorf("incomplete transaction page without cursor progress workchain=%d shard=%d seqno=%d", shard.Workchain, shard.Shard, shard.SeqNo)
+		}
+		after = shorts[len(shorts)-1].ID3()
+	}
+}
+
+func (c *tonJettonWalletCache) jettonWalletTokens(ctx context.Context, api ton.APIClientWrapped, master *ton.BlockIDExt, owner *address.Address, tokens []mdb.ChainToken) (map[string]mdb.ChainToken, error) {
+	out := make(map[string]mdb.ChainToken, len(tokens))
+	ownerRaw := addressutil.TonRawAddressObjectKey(owner)
+	for _, token := range tokens {
+		masterParsed, err := addressutil.ParseTonMainnetAddress(token.ContractAddress)
+		if err != nil {
+			return nil, fmt.Errorf("invalid jetton master symbol=%s address=%s: %w", token.Symbol, token.ContractAddress, err)
+		}
+		cacheKey := masterParsed.Raw + "|" + ownerRaw
+		c.Lock()
+		walletRaw, ok := c.walletByOwnerToken[cacheKey]
+		c.Unlock()
+		if !ok {
+			wallet, err := jetton.NewJettonMasterClient(api, masterParsed.Address).GetJettonWalletAtBlock(ctx, owner, master)
+			if err != nil {
+				return nil, fmt.Errorf("derive jetton wallet symbol=%s owner=%s: %w", token.Symbol, ownerRaw, err)
+			}
+			walletRaw = addressutil.TonRawAddressObjectKey(wallet.Address())
+			c.Lock()
+			c.walletByOwnerToken[cacheKey] = walletRaw
+			c.Unlock()
+		}
+		out[walletRaw] = token
+	}
+	return out, nil
+}
+
+func loadTonWatchState() (*tonWatchState, error) {
+	walletRows, err := data.GetAvailableWalletAddressByNetwork(mdb.NetworkTon)
+	if err != nil {
+		return nil, err
+	}
+	tokens, err := data.ListEnabledChainTokensByNetwork(mdb.NetworkTon)
+	if err != nil {
+		return nil, err
+	}
+	state := &tonWatchState{wallets: make(map[string]*address.Address)}
+	for _, row := range walletRows {
+		parsed, err := addressutil.ParseTonMainnetAddress(row.Address)
+		if err != nil {
+			log.Sugar.Warnf("[TON] skip invalid wallet address=%s err=%v", row.Address, err)
+			continue
+		}
+		state.wallets[parsed.Raw] = parsed.Address
+	}
+	for i := range tokens {
+		sym := strings.ToUpper(strings.TrimSpace(tokens[i].Symbol))
+		contract := strings.TrimSpace(tokens[i].ContractAddress)
+		switch {
+		case sym == service.TonNativeSymbol && contract == "":
+			token := tokens[i]
+			state.nativeToken = &token
+		case contract != "":
+			state.jettonTokens = append(state.jettonTokens, tokens[i])
+		}
+	}
+	return state, nil
+}
+
+func tonChainConfig() (*mdb.Chain, time.Duration) {
+	row, err := data.GetChainByNetwork(mdb.NetworkTon)
+	if err != nil || row.ID == 0 {
+		return nil, 5 * time.Second
+	}
+	interval := time.Duration(row.ScanIntervalSec) * time.Second
+	if interval <= 0 {
+		interval = 5 * time.Second
+	}
+	return row, interval
+}
+
+func tonWatchStateSignature(state *tonWatchState) string {
+	if state == nil {
+		return ""
+	}
+	return fmt.Sprintf("%d|%t|%d|%s", len(state.wallets), state.nativeToken != nil, len(state.jettonTokens), tonWalletWorkchainSummary(state))
+}
+
+func tonWalletWorkchainSummary(state *tonWatchState) string {
+	if state == nil || len(state.wallets) == 0 {
+		return "none"
+	}
+	counts := make(map[int32]int)
+	for _, wallet := range state.wallets {
+		if wallet == nil {
+			continue
+		}
+		counts[wallet.Workchain()]++
+	}
+	return formatTonWorkchainCounts(counts)
+}
+
+func tonShardWorkchainSummary(shards []*ton.BlockIDExt) string {
+	if len(shards) == 0 {
+		return "none"
+	}
+	counts := make(map[int32]int)
+	for _, shard := range shards {
+		if shard == nil {
+			continue
+		}
+		counts[shard.Workchain]++
+	}
+	return formatTonWorkchainCounts(counts)
+}
+
+func tonShardCursorKey(shard *ton.BlockIDExt) string {
+	if shard == nil {
+		return ""
+	}
+	return fmt.Sprintf("%d:%d", shard.Workchain, shard.Shard)
+}
+
+func formatTonWorkchainCounts(counts map[int32]int) string {
+	if len(counts) == 0 {
+		return "none"
+	}
+	workchains := make([]int, 0, len(counts))
+	for workchain := range counts {
+		workchains = append(workchains, int(workchain))
+	}
+	sort.Ints(workchains)
+	parts := make([]string, 0, len(workchains))
+	for _, workchain := range workchains {
+		parts = append(parts, fmt.Sprintf("%d:%d", workchain, counts[int32(workchain)]))
+	}
+	return strings.Join(parts, ",")
+}
+
+func shortTonHash(raw []byte) string {
+	hash := hex.EncodeToString(raw)
+	if len(hash) > 16 {
+		return hash[:16]
+	}
+	if hash == "" {
+		return "-"
+	}
+	return hash
+}
+
+func resolveTonLiteNode(excludeIDs ...uint64) (mdb.RpcNode, bool) {
+	node, err := data.SelectGeneralRpcNode(mdb.NetworkTon, mdb.RpcNodeTypeLite, excludeIDs...)
+	if err == nil && node != nil && node.ID > 0 {
+		node.Url = strings.TrimSpace(node.Url)
+		if node.Url != "" {
+			return *node, true
+		}
+		log.Sugar.Errorf("[TON] rpc_nodes id=%d has empty url", node.ID)
+		return mdb.RpcNode{}, false
+	}
+	if err != nil {
+		log.Sugar.Errorf("[TON] resolve lite rpc_nodes err=%v", err)
+	} else {
+		log.Sugar.Warn("[TON] no enabled lite RPC node configured in rpc_nodes")
+	}
+	return mdb.RpcNode{}, false
+}
+
+func connectTonLiteAPI(node mdb.RpcNode) (ton.APIClientWrapped, func(), error) {
+	ctx, cancel := context.WithTimeout(context.Background(), tonScannerConnectTimeout)
+	defer cancel()
+	return service.ConnectTonLiteAPI(ctx, node.Url, tonScannerRequestTimeout, 5)
+}
+
+func recordTonLiteNodeFailure(node mdb.RpcNode, reason string) {
+	data.RecordRpcFailure(mdb.NetworkTon)
+	failures, cooling := data.RecordRpcNodeFailure(node.ID)
+	nodeLabel := data.RpcNodeLogLabel(node)
+	if cooling {
+		log.Sugar.Warnf("[TON] lite node reached fail threshold (%s), node=%s failures=%d/%d", reason, nodeLabel, failures, data.RpcFailoverThreshold)
+		return
+	}
+	log.Sugar.Warnf("[TON] lite node failed (%s), node=%s failures=%d/%d", reason, nodeLabel, failures, data.RpcFailoverThreshold)
+}

src/task/listen_ton_test.go

@@ -0,0 +1,717 @@
+package task
+
+import (
+	"bytes"
+	"context"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"math/big"
+	"testing"
+	"time"
+
+	"github.com/GMWalletApp/epusdt/internal/testutil"
+	"github.com/GMWalletApp/epusdt/model/dao"
+	"github.com/GMWalletApp/epusdt/model/data"
+	"github.com/GMWalletApp/epusdt/model/mdb"
+	"github.com/GMWalletApp/epusdt/model/request"
+	"github.com/GMWalletApp/epusdt/model/service"
+	addressutil "github.com/GMWalletApp/epusdt/util/address"
+	"github.com/xssnick/tonutils-go/address"
+	"github.com/xssnick/tonutils-go/tlb"
+	"github.com/xssnick/tonutils-go/ton"
+	"github.com/xssnick/tonutils-go/ton/jetton"
+	"github.com/xssnick/tonutils-go/tvm/cell"
+)
+
+type fakeTonShardAPI struct {
+	ton.APIClientWrapped
+	shorts             []ton.TransactionShortInfo
+	shortsByShardSeq   map[uint32][]ton.TransactionShortInfo
+	incomplete         bool
+	shards             []*ton.BlockIDExt
+	shardsErr          error
+	lookupBlocks       map[uint32]*ton.BlockIDExt
+	lookupSeqs         []uint32
+	txByLT             map[uint64]*tlb.Transaction
+	fetchedLTs         []uint64
+	fetchedAddrs       []string
+	fetchedShardSeqNos []uint32
+}
+
+type fakeTonScannerAPI struct {
+	ton.APIClientWrapped
+	head              *ton.BlockIDExt
+	shards            []*ton.BlockIDExt
+	shardsErr         error
+	lookups           []uint32
+	cancel            context.CancelFunc
+	cancelAtLookupSeq uint32
+}
+
+func (f *fakeTonScannerAPI) CurrentMasterchainInfo(context.Context) (*ton.BlockIDExt, error) {
+	return f.head, nil
+}
+
+func (f *fakeTonScannerAPI) WaitForBlock(uint32) ton.APIClientWrapped {
+	return f
+}
+
+func (f *fakeTonScannerAPI) LookupBlock(_ context.Context, workchain int32, shard int64, seqno uint32) (*ton.BlockIDExt, error) {
+	f.lookups = append(f.lookups, seqno)
+	if f.cancel != nil && f.cancelAtLookupSeq == seqno {
+		f.cancel()
+	}
+	return &ton.BlockIDExt{
+		Workchain: workchain,
+		Shard:     shard,
+		SeqNo:     seqno,
+		RootHash:  bytes.Repeat([]byte{byte(seqno)}, 32),
+		FileHash:  bytes.Repeat([]byte{byte(seqno + 1)}, 32),
+	}, nil
+}
+
+func (f *fakeTonScannerAPI) GetBlockShardsInfo(context.Context, *ton.BlockIDExt) ([]*ton.BlockIDExt, error) {
+	if f.shardsErr != nil {
+		return nil, f.shardsErr
+	}
+	return f.shards, nil
+}
+
+func (f *fakeTonShardAPI) WaitForBlock(uint32) ton.APIClientWrapped {
+	return f
+}
+
+func (f *fakeTonShardAPI) GetBlockTransactionsV2(_ context.Context, block *ton.BlockIDExt, _ uint32, _ ...*ton.TransactionID3) ([]ton.TransactionShortInfo, bool, error) {
+	if block != nil {
+		f.fetchedShardSeqNos = append(f.fetchedShardSeqNos, block.SeqNo)
+	}
+	return f.blockShorts(block), f.incomplete, nil
+}
+
+func (f *fakeTonShardAPI) blockShorts(block *ton.BlockIDExt) []ton.TransactionShortInfo {
+	if block != nil && f.shortsByShardSeq != nil {
+		if shorts, ok := f.shortsByShardSeq[block.SeqNo]; ok {
+			return shorts
+		}
+	}
+	return f.shorts
+}
+
+func (f *fakeTonShardAPI) GetBlockShardsInfo(context.Context, *ton.BlockIDExt) ([]*ton.BlockIDExt, error) {
+	if f.shardsErr != nil {
+		return nil, f.shardsErr
+	}
+	return f.shards, nil
+}
+
+func (f *fakeTonShardAPI) LookupBlock(_ context.Context, workchain int32, shard int64, seqno uint32) (*ton.BlockIDExt, error) {
+	f.lookupSeqs = append(f.lookupSeqs, seqno)
+	if f.lookupBlocks != nil {
+		if block, ok := f.lookupBlocks[seqno]; ok {
+			return block, nil
+		}
+	}
+	return &ton.BlockIDExt{Workchain: workchain, Shard: shard, SeqNo: seqno}, nil
+}
+
+func (f *fakeTonShardAPI) GetTransaction(_ context.Context, _ *ton.BlockIDExt, addr *address.Address, lt uint64) (*tlb.Transaction, error) {
+	f.fetchedLTs = append(f.fetchedLTs, lt)
+	f.fetchedAddrs = append(f.fetchedAddrs, addressutil.TonRawAddressObjectKey(addr))
+	tx := f.txByLT[lt]
+	if tx == nil {
+		return nil, fmt.Errorf("missing tx lt=%d", lt)
+	}
+	return tx, nil
+}
+
+func seedTonScannerWallet(t *testing.T) {
+	t.Helper()
+	if _, err := data.AddWalletAddressWithNetwork(mdb.NetworkTon, "EQC6KV4zs8TJtSZapOrRFmqSkxzpq-oSCoxekQRKElf4nC1I"); err != nil {
+		t.Fatalf("seed TON wallet: %v", err)
+	}
+}
+
+func TestResolveTonLiteNodeSkipsCoolingPrimary(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+	data.ResetRpcFailoverForTest()
+	t.Cleanup(data.ResetRpcFailoverForTest)
+
+	rows := []mdb.RpcNode{
+		{Network: mdb.NetworkTon, Url: " https://primary-ton.example.com/global.config.json ", Type: mdb.RpcNodeTypeLite, Weight: 100, Enabled: true, Purpose: mdb.RpcNodePurposeGeneral, Status: mdb.RpcNodeStatusOk},
+		{Network: mdb.NetworkTon, Url: "https://backup-ton.example.com/global.config.json", Type: mdb.RpcNodeTypeLite, Weight: 1, Enabled: true, Purpose: mdb.RpcNodePurposeGeneral, Status: mdb.RpcNodeStatusOk},
+		{Network: mdb.NetworkTon, Url: "https://manual-ton.example.com/global.config.json", Type: mdb.RpcNodeTypeLite, Weight: 1000, Enabled: true, Purpose: mdb.RpcNodePurposeManualVerify, Status: mdb.RpcNodeStatusOk},
+		{Network: mdb.NetworkTon, Url: "https://http-ton.example.com", Type: mdb.RpcNodeTypeHttp, Weight: 2000, Enabled: true, Purpose: mdb.RpcNodePurposeGeneral, Status: mdb.RpcNodeStatusOk},
+	}
+	if err := dao.Mdb.Create(&rows).Error; err != nil {
+		t.Fatalf("seed rpc_nodes: %v", err)
+	}
+
+	primary, ok := resolveTonLiteNode()
+	if !ok {
+		t.Fatalf("resolveTonLiteNode() ok=false, want true")
+	}
+	if primary.Url != "https://primary-ton.example.com/global.config.json" {
+		t.Fatalf("primary node = %#v, want trimmed primary lite node", primary)
+	}
+	for i := 0; i < data.RpcFailoverThreshold; i++ {
+		data.RecordRpcNodeFailure(primary.ID)
+	}
+
+	got, ok := resolveTonLiteNode()
+	if !ok {
+		t.Fatalf("resolveTonLiteNode() after cooldown ok=false, want true")
+	}
+	if got.Url != "https://backup-ton.example.com/global.config.json" {
+		t.Fatalf("resolveTonLiteNode() after cooldown = %#v, want backup lite node", got)
+	}
+}
+
+func TestRunTonScannerInitializesCursorAtCurrentHead(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+	seedTonScannerWallet(t)
+
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	api := &fakeTonScannerAPI{head: &ton.BlockIDExt{
+		Workchain: address.MasterchainID,
+		Shard:     tonMasterShard,
+		SeqNo:     77,
+		RootHash:  bytes.Repeat([]byte{0x77}, 32),
+		FileHash:  bytes.Repeat([]byte{0x78}, 32),
+	}}
+	cursor := &tonRuntimeCursor{}
+	if err := runTonScanner(ctx, api, newTonJettonWalletCache(), cursor); err != nil {
+		t.Fatalf("runTonScanner(): %v", err)
+	}
+	if !cursor.initialized {
+		t.Fatal("cursor not initialized")
+	}
+	if cursor.lastMasterSeqNo != 77 {
+		t.Fatalf("cursor seqno = %d, want 77", cursor.lastMasterSeqNo)
+	}
+	if len(api.lookups) != 0 {
+		t.Fatalf("initial cursor should not backfill, lookups=%#v", api.lookups)
+	}
+}
+
+func TestRunTonScannerIdleStatesPreserveInitializedCursor(t *testing.T) {
+	tests := []struct {
+		name  string
+		setup func(t *testing.T)
+	}{
+		{
+			name: "chain disabled",
+			setup: func(t *testing.T) {
+				t.Helper()
+				seedTonScannerWallet(t)
+				if err := data.UpdateChainFields(mdb.NetworkTon, map[string]interface{}{"enabled": false}); err != nil {
+					t.Fatalf("disable TON chain: %v", err)
+				}
+			},
+		},
+		{
+			name: "no enabled wallets",
+			setup: func(t *testing.T) {
+				t.Helper()
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			cleanup := testutil.SetupTestDatabases(t)
+			defer cleanup()
+			tt.setup(t)
+
+			ctx, cancel := context.WithCancel(context.Background())
+			cancel()
+			api := &fakeTonScannerAPI{
+				head: &ton.BlockIDExt{Workchain: address.MasterchainID, Shard: tonMasterShard, SeqNo: 11},
+			}
+			cursor := &tonRuntimeCursor{initialized: true, lastMasterSeqNo: 10}
+			if err := runTonScanner(ctx, api, newTonJettonWalletCache(), cursor); err != nil {
+				t.Fatalf("runTonScanner(): %v", err)
+			}
+			if !cursor.initialized || cursor.lastMasterSeqNo != 10 {
+				t.Fatalf("cursor changed during idle state: initialized=%v seqno=%d, want initialized=true seqno=10", cursor.initialized, cursor.lastMasterSeqNo)
+			}
+		})
+	}
+}
+
+func TestRunTonScannerDoesNotAdvanceCursorOnMasterProcessingFailure(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+	seedTonScannerWallet(t)
+
+	api := &fakeTonScannerAPI{
+		head:      &ton.BlockIDExt{Workchain: address.MasterchainID, Shard: tonMasterShard, SeqNo: 11},
+		shardsErr: errors.New("shard fetch failed"),
+	}
+	cursor := &tonRuntimeCursor{initialized: true, lastMasterSeqNo: 10}
+	err := runTonScanner(context.Background(), api, newTonJettonWalletCache(), cursor)
+	if err == nil {
+		t.Fatal("expected scanner failure")
+	}
+	if cursor.lastMasterSeqNo != 10 {
+		t.Fatalf("cursor advanced after failed block: %d, want 10", cursor.lastMasterSeqNo)
+	}
+
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	api = &fakeTonScannerAPI{
+		head:   &ton.BlockIDExt{Workchain: address.MasterchainID, Shard: tonMasterShard, SeqNo: 11},
+		shards: nil,
+	}
+	if err := runTonScanner(ctx, api, newTonJettonWalletCache(), cursor); err != nil {
+		t.Fatalf("runTonScanner retry: %v", err)
+	}
+	if len(api.lookups) != 1 || api.lookups[0] != 11 {
+		t.Fatalf("retry lookups = %#v, want [11]", api.lookups)
+	}
+	if cursor.lastMasterSeqNo != 11 {
+		t.Fatalf("cursor seqno after retry = %d, want 11", cursor.lastMasterSeqNo)
+	}
+}
+
+func TestRunTonScannerDoesNotMarkCursorInitializedOnInitialShardFailure(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+	seedTonScannerWallet(t)
+
+	api := &fakeTonScannerAPI{
+		head:      &ton.BlockIDExt{Workchain: address.MasterchainID, Shard: tonMasterShard, SeqNo: 11},
+		shardsErr: errors.New("initial shard fetch failed"),
+	}
+	cursor := &tonRuntimeCursor{}
+	err := runTonScanner(context.Background(), api, newTonJettonWalletCache(), cursor)
+	if err == nil {
+		t.Fatal("expected scanner failure")
+	}
+	if cursor.initialized {
+		t.Fatal("cursor was marked initialized after failed initial shard cursor setup")
+	}
+	if cursor.lastMasterSeqNo != 0 {
+		t.Fatalf("cursor master seqno = %d, want 0", cursor.lastMasterSeqNo)
+	}
+}
+
+func TestRunTonScannerRespectsMinConfirmations(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+	seedTonScannerWallet(t)
+	if err := data.UpdateChainFields(mdb.NetworkTon, map[string]interface{}{"min_confirmations": 3}); err != nil {
+		t.Fatalf("set TON min confirmations: %v", err)
+	}
+
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	api := &fakeTonScannerAPI{
+		head: &ton.BlockIDExt{Workchain: address.MasterchainID, Shard: tonMasterShard, SeqNo: 12},
+	}
+	cursor := &tonRuntimeCursor{initialized: true, lastMasterSeqNo: 10}
+	if err := runTonScanner(ctx, api, newTonJettonWalletCache(), cursor); err != nil {
+		t.Fatalf("runTonScanner(): %v", err)
+	}
+	if len(api.lookups) != 0 {
+		t.Fatalf("scanner processed unconfirmed blocks, lookups=%#v", api.lookups)
+	}
+	if cursor.lastMasterSeqNo != 10 {
+		t.Fatalf("cursor seqno = %d, want 10", cursor.lastMasterSeqNo)
+	}
+}
+
+func TestRunTonScannerCatchupProcessesAtMostFiftyMasterBlocksPerTick(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+	seedTonScannerWallet(t)
+
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	api := &fakeTonScannerAPI{
+		head:   &ton.BlockIDExt{Workchain: address.MasterchainID, Shard: tonMasterShard, SeqNo: 100},
+		shards: nil,
+	}
+	cursor := &tonRuntimeCursor{initialized: true, lastMasterSeqNo: 1}
+	if err := runTonScanner(ctx, api, newTonJettonWalletCache(), cursor); err != nil {
+		t.Fatalf("runTonScanner(): %v", err)
+	}
+	if len(api.lookups) != int(tonMaxMasterBlocksTick) {
+		t.Fatalf("lookup count = %d, want %d", len(api.lookups), tonMaxMasterBlocksTick)
+	}
+	if cursor.lastMasterSeqNo != 51 {
+		t.Fatalf("cursor seqno = %d, want 51", cursor.lastMasterSeqNo)
+	}
+}
+
+func TestRunTonScannerCatchupContinuesUntilConfirmedHead(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+	seedTonScannerWallet(t)
+
+	ctx, cancel := context.WithCancel(context.Background())
+	api := &fakeTonScannerAPI{
+		head:              &ton.BlockIDExt{Workchain: address.MasterchainID, Shard: tonMasterShard, SeqNo: 60},
+		shards:            nil,
+		cancel:            cancel,
+		cancelAtLookupSeq: 60,
+	}
+	cursor := &tonRuntimeCursor{initialized: true, lastMasterSeqNo: 1}
+	if err := runTonScanner(ctx, api, newTonJettonWalletCache(), cursor); err != nil {
+		t.Fatalf("runTonScanner(): %v", err)
+	}
+	if len(api.lookups) != 59 {
+		t.Fatalf("lookup count = %d, want 59", len(api.lookups))
+	}
+	if api.lookups[0] != 2 || api.lookups[len(api.lookups)-1] != 60 {
+		t.Fatalf("lookups = %#v, want continuous 2..60", api.lookups)
+	}
+	for i, seq := range api.lookups {
+		want := uint32(i + 2)
+		if seq != want {
+			t.Fatalf("lookup[%d] = %d, want %d", i, seq, want)
+		}
+	}
+	if cursor.lastMasterSeqNo != 60 {
+		t.Fatalf("cursor seqno = %d, want 60", cursor.lastMasterSeqNo)
+	}
+}
+
+func TestProcessTonShardBlockFetchesOnlyWatchedWalletTransactions(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+
+	receive := address.MustParseAddr("EQC6KV4zs8TJtSZapOrRFmqSkxzpq-oSCoxekQRKElf4nC1I")
+	unwatched := address.NewAddress(0, byte(receive.Workchain()), bytes.Repeat([]byte{0x77}, 32)).Bounce(false).Testnet(false)
+	sender := address.NewAddress(0, byte(receive.Workchain()), bytes.Repeat([]byte{0x88}, 32)).Bounce(false).Testnet(false)
+
+	tx := &tlb.Transaction{
+		LT:   2,
+		Now:  uint32(time.Now().Unix()),
+		Hash: bytes.Repeat([]byte{0x99}, 32),
+		IO: struct {
+			In  *tlb.Message      `tlb:"maybe ^"`
+			Out *tlb.MessagesList `tlb:"maybe ^"`
+		}{
+			In: &tlb.Message{
+				MsgType: tlb.MsgTypeInternal,
+				Msg: &tlb.InternalMessage{
+					SrcAddr: sender,
+					DstAddr: receive,
+					Amount:  tlb.MustFromTON("1"),
+					Body:    cell.BeginCell().EndCell(),
+				},
+			},
+		},
+	}
+
+	api := &fakeTonShardAPI{
+		shorts: []ton.TransactionShortInfo{
+			{Account: unwatched.Data(), LT: 1, Hash: bytes.Repeat([]byte{0x01}, 32)},
+			{Account: receive.Data(), LT: 2, Hash: bytes.Repeat([]byte{0x02}, 32)},
+		},
+		txByLT: map[uint64]*tlb.Transaction{2: tx},
+	}
+	state := &tonWatchState{
+		wallets: map[string]*address.Address{
+			addressutil.TonRawAddressObjectKey(receive): receive,
+		},
+		nativeToken: &mdb.ChainToken{BaseModel: mdb.BaseModel{ID: 1}, Network: mdb.NetworkTon, Symbol: service.TonNativeSymbol, Decimals: 9, Enabled: true},
+	}
+
+	master := &ton.BlockIDExt{Workchain: address.MasterchainID, Shard: tonMasterShard, SeqNo: 10}
+	shard := &ton.BlockIDExt{Workchain: receive.Workchain(), Shard: 0, SeqNo: 9}
+	err := processTonShardBlock(context.Background(), api, master, shard, state, newTonJettonWalletCache())
+	if err != nil {
+		t.Fatalf("processTonShardBlock(): %v", err)
+	}
+	if len(api.fetchedLTs) != 1 || api.fetchedLTs[0] != 2 {
+		t.Fatalf("fetched LTs = %#v, want [2]", api.fetchedLTs)
+	}
+	if len(api.fetchedAddrs) != 1 || api.fetchedAddrs[0] != addressutil.TonRawAddressObjectKey(receive) {
+		t.Fatalf("fetched addresses = %#v, want watched receive address", api.fetchedAddrs)
+	}
+}
+
+func TestProcessTonMasterBlockWithCursorScansSkippedShardBlocks(t *testing.T) {
+	receive := address.MustParseAddr("EQC6KV4zs8TJtSZapOrRFmqSkxzpq-oSCoxekQRKElf4nC1I")
+	sender := address.NewAddress(0, byte(receive.Workchain()), bytes.Repeat([]byte{0x88}, 32)).Bounce(false).Testnet(false)
+	txHash := bytes.Repeat([]byte{0x42}, 32)
+	tx := &tlb.Transaction{
+		LT:   88,
+		Now:  uint32(time.Now().Unix()),
+		Hash: txHash,
+		IO: struct {
+			In  *tlb.Message      `tlb:"maybe ^"`
+			Out *tlb.MessagesList `tlb:"maybe ^"`
+		}{
+			In: &tlb.Message{
+				MsgType: tlb.MsgTypeInternal,
+				Msg: &tlb.InternalMessage{
+					SrcAddr: sender,
+					DstAddr: receive,
+					Amount:  tlb.MustFromTON("1"),
+					Body:    cell.BeginCell().EndCell(),
+				},
+			},
+		},
+	}
+
+	currentShard := &ton.BlockIDExt{Workchain: receive.Workchain(), Shard: tonMasterShard, SeqNo: 89}
+	skippedShard := &ton.BlockIDExt{Workchain: receive.Workchain(), Shard: tonMasterShard, SeqNo: 88}
+	api := &fakeTonShardAPI{
+		shards:       []*ton.BlockIDExt{currentShard},
+		lookupBlocks: map[uint32]*ton.BlockIDExt{88: skippedShard},
+		shortsByShardSeq: map[uint32][]ton.TransactionShortInfo{
+			88: {{Account: receive.Data(), LT: tx.LT, Hash: txHash}},
+			89: nil,
+		},
+		txByLT: map[uint64]*tlb.Transaction{tx.LT: tx},
+	}
+	state := &tonWatchState{
+		wallets: map[string]*address.Address{
+			addressutil.TonRawAddressObjectKey(receive): receive,
+		},
+	}
+	cursorKey := tonShardCursorKey(currentShard)
+	cursor := &tonRuntimeCursor{
+		initialized:     true,
+		lastMasterSeqNo: 10,
+		shardSeqNo:      map[string]uint32{cursorKey: 87},
+	}
+
+	master := &ton.BlockIDExt{Workchain: address.MasterchainID, Shard: tonMasterShard, SeqNo: 10}
+	err := processTonMasterBlockWithCursor(context.Background(), api, master, state, newTonJettonWalletCache(), cursor)
+	if err != nil {
+		t.Fatalf("processTonMasterBlockWithCursor(): %v", err)
+	}
+	if len(api.lookupSeqs) != 1 || api.lookupSeqs[0] != 88 {
+		t.Fatalf("lookup shard seqs = %#v, want [88]", api.lookupSeqs)
+	}
+	if len(api.fetchedShardSeqNos) != 2 || api.fetchedShardSeqNos[0] != 88 || api.fetchedShardSeqNos[1] != 89 {
+		t.Fatalf("fetched shard seqs = %#v, want [88 89]", api.fetchedShardSeqNos)
+	}
+	if len(api.fetchedLTs) != 1 || api.fetchedLTs[0] != tx.LT {
+		t.Fatalf("fetched LTs = %#v, want [%d]", api.fetchedLTs, tx.LT)
+	}
+	if cursor.shardSeqNo[cursorKey] != 89 {
+		t.Fatalf("shard cursor = %d, want 89", cursor.shardSeqNo[cursorKey])
+	}
+}
+
+func TestProcessTonShardBlockMatchesJettonUSDTOrder(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+
+	if err := data.SetSetting("rate", "rate.forced_rate_list", `{"cny":{"usdt":0.1}}`, "json"); err != nil {
+		t.Fatalf("set forced rate: %v", err)
+	}
+	receive := address.MustParseAddr("EQC6KV4zs8TJtSZapOrRFmqSkxzpq-oSCoxekQRKElf4nC1I")
+	if _, err := data.AddWalletAddressWithNetwork(mdb.NetworkTon, receive.StringRaw()); err != nil {
+		t.Fatalf("add ton wallet: %v", err)
+	}
+	resp, err := service.CreateTransaction(&request.CreateTransactionRequest{
+		OrderId:   "order_ton_usdt_shard_1",
+		Currency:  "CNY",
+		Token:     "USDT",
+		Network:   mdb.NetworkTon,
+		Amount:    10,
+		NotifyUrl: "https://93.184.216.34/callback",
+	}, nil)
+	if err != nil {
+		t.Fatalf("create TON USDT order: %v", err)
+	}
+
+	sender := address.NewAddress(0, 0, bytes.Repeat([]byte{0x31}, 32)).Bounce(false).Testnet(false)
+	jettonWallet := address.NewAddress(0, byte(receive.Workchain()), bytes.Repeat([]byte{0x44}, 32)).Bounce(false).Testnet(false)
+	body, err := tlb.ToCell(jetton.TransferNotification{
+		QueryID:        7,
+		Amount:         tlb.MustFromNano(big.NewInt(1_000_000), 6),
+		Sender:         sender,
+		ForwardPayload: cell.BeginCell().EndCell(),
+	})
+	if err != nil {
+		t.Fatalf("build jetton notification body: %v", err)
+	}
+	tx := &tlb.Transaction{
+		LT:   22,
+		Now:  uint32(time.Now().Add(time.Second).Unix()),
+		Hash: bytes.Repeat([]byte{0x42}, 32),
+		IO: struct {
+			In  *tlb.Message      `tlb:"maybe ^"`
+			Out *tlb.MessagesList `tlb:"maybe ^"`
+		}{
+			In: &tlb.Message{
+				MsgType: tlb.MsgTypeInternal,
+				Msg: &tlb.InternalMessage{
+					SrcAddr: jettonWallet,
+					DstAddr: receive,
+					Amount:  tlb.FromNanoTONU(1),
+					Body:    body,
+				},
+			},
+		},
+	}
+
+	usdtMaster, err := addressutil.ParseTonMainnetAddress("0:b113a994b5024a16719f69139328eb759596c38a25f59028b146fecdc3621dfe")
+	if err != nil {
+		t.Fatalf("parse USDT jetton master: %v", err)
+	}
+	cache := newTonJettonWalletCache()
+	ownerRaw := addressutil.TonRawAddressObjectKey(receive)
+	cache.walletByOwnerToken[usdtMaster.Raw+"|"+ownerRaw] = addressutil.TonRawAddressObjectKey(jettonWallet)
+
+	api := &fakeTonShardAPI{
+		shorts: []ton.TransactionShortInfo{
+			{Account: receive.Data(), LT: tx.LT, Hash: tx.Hash},
+		},
+		txByLT: map[uint64]*tlb.Transaction{tx.LT: tx},
+	}
+	state := &tonWatchState{
+		wallets: map[string]*address.Address{
+			ownerRaw: receive,
+		},
+		jettonTokens: []mdb.ChainToken{
+			{BaseModel: mdb.BaseModel{ID: 2}, Network: mdb.NetworkTon, Symbol: "USDT", ContractAddress: usdtMaster.Raw, Decimals: 6, Enabled: true},
+		},
+	}
+	master := &ton.BlockIDExt{Workchain: address.MasterchainID, Shard: tonMasterShard, SeqNo: 10}
+	shard := &ton.BlockIDExt{Workchain: receive.Workchain(), Shard: 0, SeqNo: 9}
+	if err := processTonShardBlock(context.Background(), api, master, shard, state, cache); err != nil {
+		t.Fatalf("processTonShardBlock(): %v", err)
+	}
+
+	order, err := data.GetOrderInfoByTradeId(resp.TradeId)
+	if err != nil {
+		t.Fatalf("reload order: %v", err)
+	}
+	if order.Status != mdb.StatusPaySuccess {
+		t.Fatalf("order status = %d, want %d", order.Status, mdb.StatusPaySuccess)
+	}
+	wantBlockID := service.TonCanonicalBlockTransactionID(receive.StringRaw(), tx.LT, hex.EncodeToString(tx.Hash))
+	if order.BlockTransactionId != wantBlockID {
+		t.Fatalf("block transaction id = %q, want %q", order.BlockTransactionId, wantBlockID)
+	}
+	lock, err := data.GetTradeIdByWalletAddressAndAmountAndToken(mdb.NetworkTon, receive.StringRaw(), "USDT", resp.ActualAmount)
+	if err != nil {
+		t.Fatalf("lookup TON USDT lock: %v", err)
+	}
+	if lock != "" {
+		t.Fatalf("TON USDT lock still exists after shard processing: %s", lock)
+	}
+}
+
+func TestProcessTonMasterBlockScansMasterchainWalletTransactions(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+
+	masterchainID := address.MasterchainID
+	masterchainByte := byte(int8(masterchainID))
+	receive := address.NewAddress(0, masterchainByte, bytes.Repeat([]byte{0x66}, 32)).Bounce(false).Testnet(false)
+	sender := address.NewAddress(0, masterchainByte, bytes.Repeat([]byte{0x88}, 32)).Bounce(false).Testnet(false)
+	tx := &tlb.Transaction{
+		LT:   2,
+		Now:  uint32(time.Now().Unix()),
+		Hash: bytes.Repeat([]byte{0x99}, 32),
+		IO: struct {
+			In  *tlb.Message      `tlb:"maybe ^"`
+			Out *tlb.MessagesList `tlb:"maybe ^"`
+		}{
+			In: &tlb.Message{
+				MsgType: tlb.MsgTypeInternal,
+				Msg: &tlb.InternalMessage{
+					SrcAddr: sender,
+					DstAddr: receive,
+					Amount:  tlb.MustFromTON("1"),
+					Body:    cell.BeginCell().EndCell(),
+				},
+			},
+		},
+	}
+	api := &fakeTonShardAPI{
+		shorts: []ton.TransactionShortInfo{
+			{Account: receive.Data(), LT: 2, Hash: bytes.Repeat([]byte{0x02}, 32)},
+		},
+		txByLT: map[uint64]*tlb.Transaction{2: tx},
+	}
+	state := &tonWatchState{
+		wallets: map[string]*address.Address{
+			addressutil.TonRawAddressObjectKey(receive): receive,
+		},
+		nativeToken: &mdb.ChainToken{BaseModel: mdb.BaseModel{ID: 1}, Network: mdb.NetworkTon, Symbol: service.TonNativeSymbol, Decimals: 9, Enabled: true},
+	}
+
+	master := &ton.BlockIDExt{Workchain: address.MasterchainID, Shard: tonMasterShard, SeqNo: 10}
+	if err := processTonMasterBlock(context.Background(), api, master, state, newTonJettonWalletCache()); err != nil {
+		t.Fatalf("processTonMasterBlock(): %v", err)
+	}
+	if len(api.fetchedLTs) != 1 || api.fetchedLTs[0] != 2 {
+		t.Fatalf("fetched LTs = %#v, want [2]", api.fetchedLTs)
+	}
+	if len(api.fetchedAddrs) != 1 || api.fetchedAddrs[0] != addressutil.TonRawAddressObjectKey(receive) {
+		t.Fatalf("fetched addresses = %#v, want masterchain receive address", api.fetchedAddrs)
+	}
+}
+
+func TestProcessTonShardBlockFailsOnIncompleteEmptyPage(t *testing.T) {
+	api := &fakeTonShardAPI{incomplete: true}
+	state := &tonWatchState{wallets: map[string]*address.Address{}}
+	master := &ton.BlockIDExt{Workchain: address.MasterchainID, Shard: tonMasterShard, SeqNo: 10}
+	shard := &ton.BlockIDExt{Workchain: 0, Shard: 0, SeqNo: 9}
+
+	err := processTonShardBlock(context.Background(), api, master, shard, state, newTonJettonWalletCache())
+	if err == nil {
+		t.Fatal("expected incomplete empty page error")
+	}
+}
+
+func TestProcessTonShardBlockFailsWhenJettonWalletsCannotBeResolved(t *testing.T) {
+	receive := address.MustParseAddr("EQC6KV4zs8TJtSZapOrRFmqSkxzpq-oSCoxekQRKElf4nC1I")
+	sender := address.NewAddress(0, byte(receive.Workchain()), bytes.Repeat([]byte{0x88}, 32)).Bounce(false).Testnet(false)
+	tx := &tlb.Transaction{
+		LT:   2,
+		Now:  uint32(time.Now().Unix()),
+		Hash: bytes.Repeat([]byte{0x99}, 32),
+		IO: struct {
+			In  *tlb.Message      `tlb:"maybe ^"`
+			Out *tlb.MessagesList `tlb:"maybe ^"`
+		}{
+			In: &tlb.Message{
+				MsgType: tlb.MsgTypeInternal,
+				Msg: &tlb.InternalMessage{
+					SrcAddr: sender,
+					DstAddr: receive,
+					Amount:  tlb.MustFromTON("1"),
+					Body:    cell.BeginCell().EndCell(),
+				},
+			},
+		},
+	}
+	api := &fakeTonShardAPI{
+		shorts: []ton.TransactionShortInfo{
+			{Account: receive.Data(), LT: 2, Hash: bytes.Repeat([]byte{0x02}, 32)},
+		},
+		txByLT: map[uint64]*tlb.Transaction{2: tx},
+	}
+	state := &tonWatchState{
+		wallets: map[string]*address.Address{
+			addressutil.TonRawAddressObjectKey(receive): receive,
+		},
+		jettonTokens: []mdb.ChainToken{
+			{BaseModel: mdb.BaseModel{ID: 1}, Network: mdb.NetworkTon, Symbol: "USDT", ContractAddress: "not-a-ton-address", Decimals: 6, Enabled: true},
+		},
+	}
+
+	master := &ton.BlockIDExt{Workchain: address.MasterchainID, Shard: tonMasterShard, SeqNo: 10}
+	shard := &ton.BlockIDExt{Workchain: receive.Workchain(), Shard: 0, SeqNo: 9}
+	err := processTonShardBlock(context.Background(), api, master, shard, state, newTonJettonWalletCache())
+	if err == nil {
+		t.Fatal("expected jetton wallet resolution failure")
+	}
+	if len(api.fetchedLTs) != 1 || api.fetchedLTs[0] != 2 {
+		t.Fatalf("fetched LTs = %#v, want [2]", api.fetchedLTs)
+	}
+}

src/task/listen_trc20_block.go

@@ -167,19 +167,32 @@ func doPost(url string, apiKey string, body interface{}) ([]byte, error) {
 func GetNowBlock(baseURL string, apiKey string) (*Block, error) {
 	b, err := doPost(baseURL+"/wallet/getnowblock", apiKey, map[string]interface{}{})
 	if err != nil {
+		data.RecordRpcFailure(mdb.NetworkTron)
 		return nil, err
 	}
 	var block Block
-	return &block, json.Unmarshal(b, &block)
+	if err := json.Unmarshal(b, &block); err != nil {
+		data.RecordRpcFailure(mdb.NetworkTron)
+		return nil, err
+	}
+	data.RecordRpcSuccess(mdb.NetworkTron)
+	data.RecordRpcBlockHeight(mdb.NetworkTron, block.BlockHeader.RawData.Number)
+	return &block, nil
 }
 
 func GetBlockByNum(baseURL string, apiKey string, num int64) (*Block, error) {
 	b, err := doPost(baseURL+"/wallet/getblockbynum", apiKey, map[string]interface{}{"num": num})
 	if err != nil {
+		data.RecordRpcFailure(mdb.NetworkTron)
 		return nil, err
 	}
 	var block Block
-	return &block, json.Unmarshal(b, &block)
+	if err := json.Unmarshal(b, &block); err != nil {
+		data.RecordRpcFailure(mdb.NetworkTron)
+		return nil, err
+	}
+	data.RecordRpcSuccess(mdb.NetworkTron)
+	return &block, nil
 }
 
 func loadTronTRC20TokenMap() map[string]mdb.ChainToken {
@@ -337,6 +350,8 @@ func processBlock(block *Block, tokenMap map[string]mdb.ChainToken) {
 type Scanner struct {
 	baseURL   string
 	apiKey    string
+	nodeID    uint64
+	nodeLabel string
 	lastBlock int64
 	// 统计
 	totalBlocks   int64
@@ -349,16 +364,16 @@ func NewScanner() *Scanner {
 }
 
 func (s *Scanner) Init() error {
-	baseURL, apiKey, err := service.ResolveTronNode()
+	node, err := service.ResolveTronRpcNode()
 	if err != nil {
 		return fmt.Errorf("resolve tron node: %w", err)
 	}
-	s.baseURL = baseURL
+	s.useRpcNode(node)
-	s.apiKey = apiKey
 
-	log.Sugar.Infof("[TRON-BLOCK] node=%s", s.baseURL)
+	log.Sugar.Infof("[TRON-BLOCK] using RPC node %s", s.nodeLabel)
 	block, err := GetNowBlock(s.baseURL, s.apiKey)
 	if err != nil {
+		s.recordRpcFailure("initial get latest block")
 		return fmt.Errorf("获取初始块失败: %w", err)
 	}
 	s.lastBlock = block.BlockHeader.RawData.Number
@@ -366,6 +381,13 @@ func (s *Scanner) Init() error {
 	return nil
 }
 
+func (s *Scanner) useRpcNode(node *mdb.RpcNode) {
+	s.baseURL = strings.TrimRight(strings.TrimSpace(node.Url), "/")
+	s.apiKey = node.ApiKey
+	s.nodeID = node.ID
+	s.nodeLabel = data.RpcNodeLogLabel(*node)
+}
+
 func (s *Scanner) Run() {
 	log.Sugar.Info("[TRON-BLOCK] start scanning (TRC20 + TRX)")
 	ticker := time.NewTicker(PollInterval)
@@ -388,14 +410,17 @@ func (s *Scanner) poll() {
 	latest, err := GetNowBlock(s.baseURL, s.apiKey)
 	if err != nil {
 		log.Sugar.Warnf("[TRON-BLOCK] get latest block: %v", err)
+		s.recordRpcFailure("get latest block")
 		return
 	}
 	latestNum := latest.BlockHeader.RawData.Number
 	if latestNum <= s.lastBlock {
+		data.RecordRpcNodeSuccess(s.nodeID)
 		return
 	}
 
 	tokenMap := loadTronTRC20TokenMap()
+	hadBlockFetchError := false
 	for num := s.lastBlock + 1; num <= latestNum; num++ {
 		var block *Block
 		if num == latestNum {
@@ -404,7 +429,8 @@ func (s *Scanner) poll() {
 			block, err = GetBlockByNum(s.baseURL, s.apiKey, num)
 			if err != nil {
 				log.Sugar.Warnf("[TRON-BLOCK] get block %d: %v", num, err)
-				continue
+				hadBlockFetchError = true
+				break
 			}
 			time.Sleep(200 * time.Millisecond)
 		}
@@ -420,6 +446,29 @@ func (s *Scanner) poll() {
 			}
 		}
 	}
+	if hadBlockFetchError {
+		s.recordRpcFailure("get historical block")
+		return
+	}
+	data.RecordRpcNodeSuccess(s.nodeID)
+}
+
+func (s *Scanner) recordRpcFailure(reason string) {
+	failures, cooling := data.RecordRpcNodeFailure(s.nodeID)
+	if !cooling {
+		log.Sugar.Warnf("[TRON-BLOCK] RPC node failed (%s), node=%s failures=%d/%d", reason, s.nodeLabel, failures, data.RpcFailoverThreshold)
+		return
+	}
+
+	log.Sugar.Warnf("[TRON-BLOCK] RPC node reached fail threshold (%s), node=%s, trying another node", reason, s.nodeLabel)
+	node, err := service.ResolveTronRpcNode(s.nodeID)
+	if err != nil {
+		log.Sugar.Warnf("[TRON-BLOCK] no alternate RPC node available after failure, keep current node=%s: %v", s.nodeLabel, err)
+		return
+	}
+	oldLabel := s.nodeLabel
+	s.useRpcNode(node)
+	log.Sugar.Warnf("[TRON-BLOCK] switched RPC node from %s to %s", oldLabel, s.nodeLabel)
 }
 
 func StartTronBlockScannerListener() {

src/task/listen_trc20_block_test.go

@@ -1,23 +1,176 @@
 package task
 
-import "testing"
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
 
-func TestTronAddressToHexConvertsBase58Contract(t *testing.T) {
+	"github.com/GMWalletApp/epusdt/internal/testutil"
-	got, err := TronAddressToHex("TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t")
+	"github.com/GMWalletApp/epusdt/model/dao"
-	if err != nil {
+	"github.com/GMWalletApp/epusdt/model/data"
-		t.Fatalf("TronAddressToHex(): %v", err)
+	"github.com/GMWalletApp/epusdt/model/mdb"
+)
+
+func TestTronScannerSwitchesNodeAfterFailureThreshold(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+	data.ResetRpcFailoverForTest()
+	t.Cleanup(data.ResetRpcFailoverForTest)
+
+	primary := &mdb.RpcNode{
+		Network: mdb.NetworkTron,
+		Url:     "https://primary-tron.example.com",
+		Type:    mdb.RpcNodeTypeHttp,
+		Weight:  100,
+		Enabled: true,
+		Purpose: mdb.RpcNodePurposeGeneral,
+		Status:  mdb.RpcNodeStatusOk,
+	}
+	backup := &mdb.RpcNode{
+		Network: mdb.NetworkTron,
+		Url:     "https://backup-tron.example.com",
+		Type:    mdb.RpcNodeTypeHttp,
+		Weight:  1,
+		Enabled: true,
+		Purpose: mdb.RpcNodePurposeGeneral,
+		Status:  mdb.RpcNodeStatusOk,
+	}
+	if err := dao.Mdb.Create(primary).Error; err != nil {
+		t.Fatalf("seed primary rpc_node: %v", err)
+	}
+	if err := dao.Mdb.Create(backup).Error; err != nil {
+		t.Fatalf("seed backup rpc_node: %v", err)
 	}
 
-	const want = "41a614f803b6fd780986a42c78ec9c7f77e6ded13c"
+	scanner := NewScanner()
-	if got != want {
+	scanner.useRpcNode(primary)
-		t.Fatalf("TronAddressToHex() = %q, want %q", got, want)
+	for i := 0; i < data.RpcFailoverThreshold-1; i++ {
+		scanner.recordRpcFailure("test")
+		if scanner.nodeID != primary.ID {
+			t.Fatalf("node switched before threshold to id=%d", scanner.nodeID)
+		}
+	}
+
+	scanner.recordRpcFailure("test")
+	if scanner.nodeID != backup.ID {
+		t.Fatalf("scanner node id = %d, want backup id=%d", scanner.nodeID, backup.ID)
+	}
+	if scanner.baseURL != backup.Url {
+		t.Fatalf("scanner baseURL = %q, want %q", scanner.baseURL, backup.Url)
 	}
 }
 
-func TestNormalizeTronHexAddress(t *testing.T) {
+func TestTronScannerStopsOnHistoricalBlockFetchError(t *testing.T) {
-	got := normalizeTronHexAddress("0X41A614F803B6FD780986A42C78EC9C7F77E6DED13C")
+	cleanup := testutil.SetupTestDatabases(t)
-	const want = "41a614f803b6fd780986a42c78ec9c7f77e6ded13c"
+	defer cleanup()
-	if got != want {
+	data.ResetRpcFailoverForTest()
-		t.Fatalf("normalizeTronHexAddress() = %q, want %q", got, want)
+	t.Cleanup(data.ResetRpcFailoverForTest)
+
+	node := &mdb.RpcNode{
+		Network: mdb.NetworkTron,
+		Type:    mdb.RpcNodeTypeHttp,
+		Weight:  1,
+		Enabled: true,
+		Purpose: mdb.RpcNodePurposeGeneral,
+		Status:  mdb.RpcNodeStatusOk,
+	}
+	if err := dao.Mdb.Create(node).Error; err != nil {
+		t.Fatalf("seed rpc_node: %v", err)
+	}
+
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		switch r.URL.Path {
+		case "/wallet/getnowblock":
+			_ = json.NewEncoder(w).Encode(map[string]interface{}{
+				"block_header": map[string]interface{}{
+					"raw_data": map[string]interface{}{
+						"number":    3,
+						"timestamp": int64(1000),
+					},
+				},
+				"transactions": []interface{}{},
+			})
+		case "/wallet/getblockbynum":
+			http.Error(w, "temporary", http.StatusBadGateway)
+		default:
+			http.NotFound(w, r)
+		}
+	}))
+	defer server.Close()
+
+	node.Url = server.URL
+	scanner := NewScanner()
+	scanner.useRpcNode(node)
+	scanner.lastBlock = 1
+
+	scanner.poll()
+	if scanner.lastBlock != 1 {
+		t.Fatalf("lastBlock = %d, want 1 so failed block is retried", scanner.lastBlock)
+	}
+}
+
+func TestTronRPCRecordsRuntimeStats(t *testing.T) {
+	data.ResetRpcRuntimeStatsForTest()
+	t.Cleanup(data.ResetRpcRuntimeStatsForTest)
+
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		switch r.URL.Path {
+		case "/wallet/getnowblock":
+			_ = json.NewEncoder(w).Encode(map[string]interface{}{
+				"block_header": map[string]interface{}{
+					"raw_data": map[string]interface{}{
+						"number":    10,
+						"timestamp": int64(1000),
+					},
+				},
+				"transactions": []interface{}{},
+			})
+		case "/wallet/getblockbynum":
+			_ = json.NewEncoder(w).Encode(map[string]interface{}{
+				"block_header": map[string]interface{}{
+					"raw_data": map[string]interface{}{
+						"number":    9,
+						"timestamp": int64(1000),
+					},
+				},
+				"transactions": []interface{}{},
+			})
+		default:
+			http.NotFound(w, r)
+		}
+	}))
+	defer server.Close()
+
+	if _, err := GetNowBlock(server.URL, ""); err != nil {
+		t.Fatalf("GetNowBlock(): %v", err)
+	}
+	if _, err := GetBlockByNum(server.URL, "", 9); err != nil {
+		t.Fatalf("GetBlockByNum(): %v", err)
+	}
+
+	failing := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		http.Error(w, "temporary", http.StatusBadGateway)
+	}))
+	defer failing.Close()
+	if _, err := GetBlockByNum(failing.URL, "", 8); err == nil {
+		t.Fatal("GetBlockByNum() error = nil, want failure")
+	}
+
+	stats := data.SnapshotRpcRuntimeStats()
+	tron := stats[mdb.NetworkTron]
+	if tron.SuccessCount != 2 {
+		t.Fatalf("tron success_count = %d, want 2", tron.SuccessCount)
+	}
+	if tron.FailureCount != 1 {
+		t.Fatalf("tron failure_count = %d, want 1", tron.FailureCount)
+	}
+	if tron.LatestBlockHeight != 10 {
+		t.Fatalf("tron latest_block_height = %d, want 10", tron.LatestBlockHeight)
+	}
+	if tron.LastSyncAt.IsZero() {
+		t.Fatal("tron last_sync_at is zero")
 	}
 }

src/task/rpc_health_job.go

@@ -14,9 +14,9 @@ import (
 
 const rpcProbeTimeout = 5 * time.Second
 
-// RpcHealthJob periodically probes every enabled rpc_nodes row and
+// RpcHealthJob periodically probes enabled general/both rpc_nodes rows.
-// writes status/last_latency_ms. Results drive SelectRpcNode weighted
+// Manual verification nodes are left for on-demand admin checks so paid
-// picking at runtime.
+// endpoints are not consumed by the scheduler.
 type RpcHealthJob struct{}
 
 var gRpcHealthJobLock sync.Mutex
@@ -25,7 +25,7 @@ func (r RpcHealthJob) Run() {
 	gRpcHealthJobLock.Lock()
 	defer gRpcHealthJobLock.Unlock()
 
-	nodes, err := data.ListRpcNodes("")
+	nodes, err := data.ListRpcNodesForHealth()
 	if err != nil {
 		log.Sugar.Errorf("[rpc-health] list nodes err=%v", err)
 		return

src/telegram/utils.go

@@ -6,6 +6,7 @@ import (
 	"strings"
 
 	"github.com/GMWalletApp/epusdt/model/mdb"
+	addressutil "github.com/GMWalletApp/epusdt/util/address"
 	"github.com/btcsuite/btcutil/base58"
 	"github.com/gagliardetto/solana-go"
 )
@@ -53,6 +54,9 @@ func isValidAddressByNetwork(network, addr string) bool {
 		return isValidTronAddress(addr)
 	case mdb.NetworkSolana:
 		return isValidSolanaAddress(addr)
+	case mdb.NetworkTon:
+		_, err := addressutil.ParseTonMainnetAddress(addr)
+		return err == nil
 	default:
 		// 其余 EVM 链统一使用 0x 地址校验
 		return isValidEthereumAddress(addr)
@@ -64,6 +68,11 @@ func normalizeWalletAddressByNetwork(network, addr string) string {
 	switch strings.ToLower(strings.TrimSpace(network)) {
 	case mdb.NetworkTron, mdb.NetworkSolana:
 		return addr
+	case mdb.NetworkTon:
+		if normalized, err := addressutil.NormalizeTonAddress(addr); err == nil {
+			return normalized
+		}
+		return addr
 	default:
 		return strings.ToLower(addr)
 	}

src/util/address/ton.go

@@ -0,0 +1,135 @@
+package addressutil
+
+import (
+	"encoding/base64"
+	"encoding/binary"
+	"fmt"
+	"strings"
+
+	"github.com/xssnick/tonutils-go/address"
+	"github.com/xssnick/tonutils-go/crc16"
+)
+
+// TonParsedAddress carries the canonical display and raw forms used by epusdt.
+type TonParsedAddress struct {
+	Address *address.Address
+	Display string
+	Raw     string
+}
+
+// ParseTonMainnetAddress accepts raw and user-friendly TON addresses and rejects
+// user-friendly testnet-only addresses. Raw addresses do not contain a testnet
+// flag, so they are treated as mainnet addresses by definition.
+func ParseTonMainnetAddress(input string) (*TonParsedAddress, error) {
+	raw := strings.TrimSpace(input)
+	if raw == "" {
+		return nil, fmt.Errorf("ton address is empty")
+	}
+
+	var (
+		addr       *address.Address
+		err        error
+		checkFlags bool
+	)
+	if strings.Contains(raw, ":") {
+		addr, err = address.ParseRawAddr(raw)
+	} else {
+		addr, err = parseUserFriendly(raw)
+		checkFlags = true
+	}
+	if err != nil {
+		return nil, err
+	}
+	if addr == nil || addr.Type() != address.StdAddress || addr.IsAddrNone() {
+		return nil, fmt.Errorf("unsupported ton address type")
+	}
+	if checkFlags && addr.IsTestnetOnly() {
+		return nil, fmt.Errorf("testnet-only ton address is not supported")
+	}
+
+	mainnet := addr.Bounce(false).Testnet(false)
+	return &TonParsedAddress{
+		Address: mainnet,
+		Display: mainnet.String(),
+		Raw:     strings.ToLower(mainnet.StringRaw()),
+	}, nil
+}
+
+// NormalizeTonAddress returns the canonical user-friendly address stored in DB.
+func NormalizeTonAddress(input string) (string, error) {
+	parsed, err := ParseTonMainnetAddress(input)
+	if err != nil {
+		return "", err
+	}
+	return parsed.Display, nil
+}
+
+// TonRawAddressKey returns the workchain:hash key used for comparisons and locks.
+func TonRawAddressKey(input string) (string, error) {
+	parsed, err := ParseTonMainnetAddress(input)
+	if err != nil {
+		return "", err
+	}
+	return parsed.Raw, nil
+}
+
+// NormalizeTonAddressObject returns the canonical user-friendly form for a parsed
+// address object.
+func NormalizeTonAddressObject(addr *address.Address) string {
+	if addr == nil {
+		return ""
+	}
+	return addr.Bounce(false).Testnet(false).String()
+}
+
+// TonRawAddressObjectKey returns the raw workchain:hash key for a parsed address.
+func TonRawAddressObjectKey(addr *address.Address) string {
+	if addr == nil {
+		return ""
+	}
+	return strings.ToLower(addr.Bounce(false).Testnet(false).StringRaw())
+}
+
+// TonAddressFromShortAccount builds a standard TON address from a shard
+// transaction account id returned by liteserver block transaction lists.
+func TonAddressFromShortAccount(workchain int32, account []byte) *address.Address {
+	if len(account) != 32 {
+		return nil
+	}
+	return address.NewAddress(0, byte(workchain), append([]byte(nil), account...)).Bounce(false).Testnet(false)
+}
+
+func parseUserFriendly(input string) (*address.Address, error) {
+	if addr, err := address.ParseAddr(input); err == nil {
+		return addr, nil
+	}
+	for _, enc := range []*base64.Encoding{
+		base64.RawStdEncoding,
+		base64.StdEncoding,
+		base64.URLEncoding,
+	} {
+		data, err := enc.DecodeString(input)
+		if err != nil {
+			continue
+		}
+		addr, err := addressFromFriendlyBytes(data)
+		if err == nil {
+			return addr, nil
+		}
+	}
+	return nil, fmt.Errorf("invalid ton address")
+}
+
+func addressFromFriendlyBytes(data []byte) (*address.Address, error) {
+	if len(data) != 36 {
+		return nil, fmt.Errorf("incorrect ton address data length")
+	}
+	want := binary.BigEndian.Uint16(data[34:])
+	if crc16.ChecksumXMODEM(data[:34]) != want {
+		return nil, fmt.Errorf("invalid ton address checksum")
+	}
+	if len(data[2:34]) != 32 {
+		return nil, fmt.Errorf("incorrect ton address hash length")
+	}
+	return address.NewAddress(data[0], data[1], append([]byte(nil), data[2:34]...)), nil
+}

src/util/address/ton_test.go

@@ -0,0 +1,56 @@
+package addressutil
+
+import (
+	"encoding/base64"
+	"strings"
+	"testing"
+
+	"github.com/xssnick/tonutils-go/address"
+)
+
+const testTonBounceable = "EQC6KV4zs8TJtSZapOrRFmqSkxzpq-oSCoxekQRKElf4nC1I"
+
+func TestParseTonMainnetAddressNormalizesSupportedFormats(t *testing.T) {
+	base := address.MustParseAddr(testTonBounceable)
+	raw := base.StringRaw()
+	nonBounce := base.Bounce(false).String()
+	rawBytes, err := base64.RawURLEncoding.DecodeString(testTonBounceable)
+	if err != nil {
+		t.Fatalf("decode fixture: %v", err)
+	}
+	stdBase64 := base64.RawStdEncoding.EncodeToString(rawBytes)
+
+	for _, input := range []string{testTonBounceable, nonBounce, raw, stdBase64} {
+		parsed, err := ParseTonMainnetAddress(input)
+		if err != nil {
+			t.Fatalf("ParseTonMainnetAddress(%q): %v", input, err)
+		}
+		if parsed.Display != nonBounce {
+			t.Fatalf("display for %q = %q, want %q", input, parsed.Display, nonBounce)
+		}
+		if parsed.Raw != strings.ToLower(raw) {
+			t.Fatalf("raw for %q = %q, want %q", input, parsed.Raw, strings.ToLower(raw))
+		}
+	}
+}
+
+func TestParseTonMainnetAddressRejectsTestnetOnly(t *testing.T) {
+	testnet := address.MustParseAddr(testTonBounceable).Testnet(true).String()
+	if _, err := ParseTonMainnetAddress(testnet); err == nil {
+		t.Fatal("expected testnet-only address to be rejected")
+	}
+}
+
+func TestTonAddressFromShortAccount(t *testing.T) {
+	base := address.MustParseAddr(testTonBounceable)
+	got := TonAddressFromShortAccount(base.Workchain(), base.Data())
+	if got == nil {
+		t.Fatal("TonAddressFromShortAccount() returned nil")
+	}
+	if TonRawAddressObjectKey(got) != TonRawAddressObjectKey(base) {
+		t.Fatalf("raw address = %q, want %q", TonRawAddressObjectKey(got), TonRawAddressObjectKey(base))
+	}
+	if got = TonAddressFromShortAccount(base.Workchain(), base.Data()[:31]); got != nil {
+		t.Fatalf("TonAddressFromShortAccount() with short account = %#v, want nil", got)
+	}
+}

src/util/constant/errno.go

@@ -1,5 +1,7 @@
 package constant
 
+import "errors"
+
 var Errno = map[int]string{
 	400:   "system error",
 	401:   "signature verification failed",
@@ -21,6 +23,33 @@ var Errno = map[int]string{
 	10017: "payment provider is not enabled",
 	10018: "payment provider configuration is incomplete",
 	10019: "payment provider does not support this token or network",
+	10020: "invalid rpc node purpose",
+	10021: "invalid rpc node url",
+	10022: "rpc node http url required",
+	10023: "rpc node websocket url required",
+	10024: "invalid rpc node type",
+	10025: "invalid username or password",
+	10026: "admin user disabled",
+	10027: "admin unauthorized",
+	10028: "admin user not found",
+	10029: "old password incorrect",
+	10030: "wallet not found",
+	10031: "api key not found",
+	10032: "rpc node not found",
+	10033: "order callback not applicable",
+	10034: "order notify url empty",
+	10035: "resend callback failed",
+	10036: "invalid notification config",
+	10037: "invalid notification events",
+	10038: "manual payment verification failed",
+	10039: "manual payment only supports on-chain orders",
+	10040: "initial admin password unavailable, check from logs",
+	10041: "invalid notify url",
+	10042: "payment provider order creation failed",
+	10043: "invalid setting item",
+	10044: "invalid order redirect url",
+	10045: "order api key unavailable",
+	10046: "failed to build epay return signature",
 }
 
 var (
@@ -44,6 +73,33 @@ var (
 	PaymentProviderNotEnabled  = Err(10017)
 	PaymentProviderConfigErr   = Err(10018)
 	PaymentProviderNotSupport  = Err(10019)
+	RpcNodePurposeErr          = Err(10020)
+	RpcNodeURLErr              = Err(10021)
+	RpcNodeHTTPURLErr          = Err(10022)
+	RpcNodeWebSocketURLErr     = Err(10023)
+	RpcNodeTypeErr             = Err(10024)
+	AdminInvalidCredentialErr  = Err(10025)
+	AdminUserDisabledErr       = Err(10026)
+	AdminUnauthorizedErr       = Err(10027)
+	AdminUserNotFoundErr       = Err(10028)
+	AdminOldPasswordErr        = Err(10029)
+	WalletNotFoundErr          = Err(10030)
+	ApiKeyNotFoundErr          = Err(10031)
+	RpcNodeNotFoundErr         = Err(10032)
+	OrderCallbackNotApplicable = Err(10033)
+	OrderNotifyURLEmptyErr     = Err(10034)
+	OrderResendCallbackErr     = Err(10035)
+	NotificationConfigErr      = Err(10036)
+	NotificationEventsErr      = Err(10037)
+	ManualPaymentVerifyErr     = Err(10038)
+	ManualPaymentProviderErr   = Err(10039)
+	InitialAdminPasswordErr    = Err(10040)
+	NotifyURLErr               = Err(10041)
+	PaymentProviderCreateErr   = Err(10042)
+	SettingItemErr             = Err(10043)
+	OrderRedirectURLErr        = Err(10044)
+	OrderApiKeyUnavailableErr  = Err(10045)
+	EPayReturnSignatureErr     = Err(10046)
 )
 
 type RspError struct {
@@ -67,6 +123,14 @@ func (re *RspError) Render() (code int, msg string) {
 	return re.Code, re.Msg
 }
 
+func ResolveErrno(err error) (code int, msg string) {
+	var rspErr *RspError
+	if errors.As(err, &rspErr) {
+		return rspErr.Render()
+	}
+	return SystemErr.(*RspError).Render()
+}
+
 // HttpStatus maps a RspError code to the HTTP status the handler
 // should use on the wire. Small codes (< 1000) are treated as real
 // HTTP status codes (e.g. 400 system error, 401 signature failure) so

src/util/http/response.go

@@ -1,6 +1,7 @@
 package http
 
 import (
+	"errors"
 	"github.com/GMWalletApp/epusdt/util/constant"
 	"github.com/GMWalletApp/epusdt/util/page"
 	"github.com/labstack/echo/v4"
@@ -65,13 +66,12 @@ func (r *Resp) SucJsonPage(e echo.Context, data interface{}, pagination page.Pag
 func (r *Resp) FailJson(e echo.Context, err error) error {
 	rr := new(Response)
 	httpStatus := http.StatusBadRequest
-	switch t := err.(type) {
+	var rspErr *constant.RspError
-	case *constant.RspError:
+	if errors.As(err, &rspErr) {
-		rr.StatusCode, rr.Message = t.Render()
+		rr.StatusCode, rr.Message = rspErr.Render()
-		httpStatus = t.HttpStatus()
+		httpStatus = rspErr.HttpStatus()
-	default:
+	} else {
-		rr.StatusCode = http.StatusBadRequest
+		rr.StatusCode, rr.Message = constant.ResolveErrno(err)
-		rr.Message = err.Error()
 	}
 	rr.RequestID = e.Request().Header.Get(echo.HeaderXRequestID)
 	return r.Json(e, httpStatus, &rr)

src/util/http/response_test.go

@@ -0,0 +1,61 @@
+package http
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	nethttp "net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/GMWalletApp/epusdt/util/constant"
+	"github.com/labstack/echo/v4"
+)
+
+func TestFailJsonHidesPlainErrorsBehindSystemErrno(t *testing.T) {
+	e := echo.New()
+	req := httptest.NewRequest(nethttp.MethodGet, "/", nil)
+	rec := httptest.NewRecorder()
+	ctx := e.NewContext(req, rec)
+
+	if err := new(Resp).FailJson(ctx, errors.New("database connection details")); err != nil {
+		t.Fatalf("FailJson returned error: %v", err)
+	}
+	if rec.Code != nethttp.StatusBadRequest {
+		t.Fatalf("http status = %d, want 400", rec.Code)
+	}
+
+	var body map[string]interface{}
+	if err := json.Unmarshal(rec.Body.Bytes(), &body); err != nil {
+		t.Fatalf("unmarshal response: %v", err)
+	}
+	if got := int(body["status_code"].(float64)); got != 400 {
+		t.Fatalf("status_code = %d, want 400; body=%v", got, body)
+	}
+	if got, _ := body["message"].(string); got != constant.Errno[400] {
+		t.Fatalf("message = %q, want %q", got, constant.Errno[400])
+	}
+}
+
+func TestFailJsonPreservesWrappedRspErrorErrno(t *testing.T) {
+	e := echo.New()
+	req := httptest.NewRequest(nethttp.MethodGet, "/", nil)
+	rec := httptest.NewRecorder()
+	ctx := e.NewContext(req, rec)
+
+	err := fmt.Errorf("wrap: %w", constant.OrderNotExists)
+	if callErr := new(Resp).FailJson(ctx, err); callErr != nil {
+		t.Fatalf("FailJson returned error: %v", callErr)
+	}
+
+	var body map[string]interface{}
+	if err := json.Unmarshal(rec.Body.Bytes(), &body); err != nil {
+		t.Fatalf("unmarshal response: %v", err)
+	}
+	if got := int(body["status_code"].(float64)); got != 10008 {
+		t.Fatalf("status_code = %d, want 10008; body=%v", got, body)
+	}
+	if got, _ := body["message"].(string); got != constant.Errno[10008] {
+		t.Fatalf("message = %q, want %q", got, constant.Errno[10008])
+	}
+}

src/util/log/log.go

@@ -2,6 +2,9 @@ package log
 
 import (
 	"fmt"
+	"strings"
+	"sync"
+
 	"github.com/GMWalletApp/epusdt/config"
 	"github.com/natefinch/lumberjack"
 	"github.com/spf13/viper"
@@ -13,11 +16,16 @@ import (
 
 var Sugar *zap.SugaredLogger
 
+var (
+	atomicLevel = zap.NewAtomicLevelAt(zapcore.InfoLevel)
+	levelMu     sync.Mutex
+)
+
 func Init() {
-	level := getLogLevel()
+	atomicLevel.SetLevel(getLogLevel())
 	core := zapcore.NewTee(
-		zapcore.NewCore(getConsoleEncoder(), getConsoleWriter(), level),
+		zapcore.NewCore(getConsoleEncoder(), getConsoleWriter(), atomicLevel),
-		zapcore.NewCore(getFileEncoder(), getFileWriter(), level),
+		zapcore.NewCore(getFileEncoder(), getFileWriter(), atomicLevel),
 	)
 	logger := zap.New(core, zap.AddCaller())
 	Sugar = logger.Sugar()
@@ -56,14 +64,75 @@ func getConsoleWriter() zapcore.WriteSyncer {
 }
 
 func getLogLevel() zapcore.Level {
-	switch config.LogLevel {
+	level, _, err := parseLevel(config.LogLevel)
-	case "debug":
+	if err != nil {
-		return zapcore.DebugLevel
-	case "warn":
-		return zapcore.WarnLevel
-	case "error":
-		return zapcore.ErrorLevel
-	default:
 		return zapcore.InfoLevel
 	}
+	return level
+}
+
+func SetLevel(level string) error {
+	nextLevel, normalized, err := parseLevel(level)
+	if err != nil {
+		return err
+	}
+
+	levelMu.Lock()
+	defer levelMu.Unlock()
+
+	currentLevel := atomicLevel.Level()
+	current := levelToString(currentLevel)
+	if current == normalized {
+		return nil
+	}
+
+	message := fmt.Sprintf("[log] level changed: %s -> %s", current, normalized)
+	if Sugar != nil && currentLevel <= zapcore.WarnLevel {
+		Sugar.Warn(message)
+	}
+	atomicLevel.SetLevel(nextLevel)
+	if Sugar != nil && currentLevel > zapcore.WarnLevel {
+		Sugar.Warn(message)
+	}
+	return nil
+}
+
+func CurrentLevel() string {
+	return levelToString(atomicLevel.Level())
+}
+
+func NormalizeLevel(level string) (string, error) {
+	_, normalized, err := parseLevel(level)
+	return normalized, err
+}
+
+func parseLevel(level string) (zapcore.Level, string, error) {
+	normalized := strings.ToLower(strings.TrimSpace(level))
+	switch normalized {
+	case "debug":
+		return zapcore.DebugLevel, normalized, nil
+	case "info":
+		return zapcore.InfoLevel, normalized, nil
+	case "warn":
+		return zapcore.WarnLevel, normalized, nil
+	case "error":
+		return zapcore.ErrorLevel, normalized, nil
+	default:
+		return zapcore.InfoLevel, "", fmt.Errorf("unsupported log level %q", level)
+	}
+}
+
+func levelToString(level zapcore.Level) string {
+	switch level {
+	case zapcore.DebugLevel:
+		return "debug"
+	case zapcore.InfoLevel:
+		return "info"
+	case zapcore.WarnLevel:
+		return "warn"
+	case zapcore.ErrorLevel:
+		return "error"
+	default:
+		return level.String()
+	}
 }