fix (reviewed): KYC webhook handler processes duplicate deliveries

[dotunv]

Summary

Reviewed and verified fix for KYC webhook handler duplicate delivery.

Original Bug

The KYC webhook handler does not implement idempotency checks, causing duplicate KYC status updates when the webhook provider retries deliveries. This can flip a user's KYC status back and forth if the retry arrives after a manual override.

Review Status

• Root cause identified in backend/src/routes/kycWebhook.js — no duplicate check
• Fix verified: handler now checks processed_at timestamp before applying updates
• Regression test added for duplicate webhook delivery scenarios
• Edge cases tested: out-of-order delivery, late retries after manual status change

Verification

Sent 3 identical KYC webhook payloads. Only the first was processed; subsequent deliveries returned 200 without side effects.

Labels

bug, backend, reviewed fix, Maybe Rewarded, GrantFox OSS, Official Campaign

[M2u0i0z]

@M2u0i0z has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

I understand the expected outcome and would love to work on this. I'll provide a solution that satisfies the acceptance criteria. Please 🙏 Boss

ℹ️ Repo Maintainers: To accept this application, review their application or assign @M2u0i0z to this issue.

[Ultra-Tech-code]

@Ultra-Tech-code has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hi Maintainer, I’m a web3 fullstack developer. I’ve reviewed issue #736 and understand the requirements. I’d like to implement and verify this fix, then submit a clean PR.

My approach:

• Review the KYC webhook idempotency implementation around processed_at.
• Verify duplicate, out-of-order, and late-retry scenarios.
• Add or strengthen regression tests to ensure repeated deliveries have no side effects.
• Confirm manual KYC status changes cannot be overwritten by stale webhook retries.

Kindly assign this issue to me.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Ultra-Tech-code to this issue.

[CRSabers]

@CRSabers has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hi! I’d like to take this issue. I’ll implement the reviewed idempotency fix for duplicate KYC webhook deliveries so retries cannot apply the same status transition more than once or incorrectly revert a user’s state. I’ll add focused regression coverage for duplicate and out-of-order deliveries, run the affected tests, and keep the PR narrowly scoped. Thank you!

ℹ️ Repo Maintainers: To accept this application, review their application or assign @CRSabers to this issue.

[drips-wave]

Congratulations, @M2u0i0z! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on August 31, 2026.

🧑‍💻 @M2u0i0z: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊