[alagbesadat208-prog]

Summary

Four backend fixes, one per issue. All changes are covered by tests.

#2019 — requestLoan compared tokens against stroops

req.body.amount is in human-readable token units, while sorobanService.getPoolBalance() returns raw stroops (10^7 per token). The pre-flight check compared the two numbers directly, so it was off by 10^7.

• Compare toStroops(amount.toString()) against the balance in stroops.
• Report both sides in token units in the error message (formatted through money/decimal.ts, trailing settlement zeros trimmed).

#2021 — getScoreBreakdown returned an empty breakdown for users without a scores row

current_score_cte had no aggregate, so it produced 0 rows for users with loan activity in contract_events but no scores row. The CROSS JOINs then discarded every computed loan_stats/timing_stats value.

• Use COALESCE(MAX(current_score), 500) so the CTE always yields exactly one row.
• updateScore already invalidates score:breakdown:${userId} — confirmed, no change needed.

#2020 — contestDefault wrote an invalid event outside a transaction

• Wrapped the loan_disputes insert and the contract_events marker in one withTransaction, so a failed event insert no longer leaves an orphaned dispute row.
• Filled every NOT NULL column on contract_events: event_id (randomUUID()), ledger: 0, tx_hash: dispute:<disputeId>, contract_id from LOAN_MANAGER_CONTRACT_ID (fallback offchain_dispute), matching the admin dispute endpoints.

#2022 — buildDepositTx left minSharesOut unscaled and the schema dropped it

• Scale minSharesOut with toStroops(minSharesOut.toString()) before encoding it as i128, so the slippage bound is no longer 10^7 times too small (and fractional values no longer throw RangeError).
• Added minSharesOut: z.number().nonnegative().optional() to buildPoolTransactionSchema.

Tests

• sorobanService.stroops.test.ts: asserts minSharesOut (integer and fractional) is scaled to stroops.
• loanEndpoints.test.ts: pool-liquidity pre-flight accepts/rejects in token units and formats the shortfall in tokens.
• scoreBreakdown.test.ts: asserts the score CTE is aggregated so event stats survive.
• loanDispute.test.ts / integration/loanDisputeFlow.test.ts: run through withTransaction and assert the dispute event supplies event_id, ledger, tx_hash and contract_id.
• validation.test.ts: minSharesOut is accepted, optional, and rejects negatives.

npm run typecheck passes, eslint reports no errors on the touched files, and the full backend suite passes (124 suites, 1066 tests; 4 suites skipped).

Closes #2019
Closes #2020
Closes #2021
Closes #2022

[github-actions]

Malware detection scan flagged this pull request

The scan found 1 indicator(s) in the PR diff. This PR is blocked until a maintainer reviews the flagged files.

• backend/src/services/__tests__/sorobanService.stroops.test.ts — hidden-appended-config-payload (high)

This is an automated triage signal; maintainers must verify whether the finding is malicious or intentional.