AI Investment v6.0.8

Release Date: March 6, 2026 Tags: CRITICAL FIXES, SECURITY, WALLET INTEGRITY, RACE CONDITIONS, FRONTEND

Overview

Version 6.0.8 is a comprehensive audit and hardening release for the AI Investment addon. It fixes critical financial integrity bugs including double-credit vulnerabilities, race conditions in concurrent investment processing, missing wallet side-effects on admin status changes, and an information disclosure vulnerability. It also corrects the expected profit display to match actual payout logic, and adds pagination to the investment list endpoint.

Update Instructions

After updating, run the following command in terminal:

pnpm updator

Changed

The investment list is paginated

• Changed the investment list to accept a page size — 20 by default, 100 at most — and an offset, and to report the total alongside the page. It previously fetched a customer's entire history with no limit at all, which grows without bound. The maturity check still runs across every active investment regardless of which page is requested.

The completion notification links to the right place

• Changed the link in the investment completion notification, which pointed at an address that has never existed, so it now opens the investment.

Referrers are no longer rewarded twice

• Changed reward processing to happen only when an investment is created. It also ran on completion, so a referrer was paid twice for the same investment.

Fixed

Security: one customer could read another's investments

• Fixed the investment detail endpoint returning any record by its id without checking who was asking, so any signed-in customer could read another customer's investment by guessing or enumerating ids. A request for somebody else's record is now refused.

A matured investment could be paid out twice

• Fixed a matured investment being credited twice when the scheduled run and a customer opening their investment list processed it at the same moment. Neither held a lock, so both could see it as still active. The scheduled run now locks the investment and stops if it is no longer active by the time it holds the lock.
• Fixed the scheduled run and admin completion sharing one duplicate-payment key, which meant an admin completing an investment after a failed scheduled run was silently blocked. The two paths now use separate keys.

Admin status changes moved no money at all

• Fixed the admin status action updating an investment's status without touching the wallet — completing paid nothing out, and cancelling or rejecting refunded nothing. It now does the following, in a single transaction with the wallet row locked:
  • Completed: the payout is calculated from the result — a win pays the amount plus its return, a loss pays the amount less its return, a draw returns the amount — credited to the customer's wallet, and the result and profit are recorded.
  • Cancelled or rejected: the full invested amount is refunded.

Cancelling an investment could lose the customer's money

• Fixed cancellation destroying the investment record before issuing the refund. If the refund then failed, the investment was gone and the customer's funds were not returned. The original debit is now located and the refund issued before the record is removed, all within one transaction.
• Fixed cancellation being attempted on investments that were already completed, rejected or cancelled. Only an active investment can be cancelled, and it is refused before any wallet operation is attempted.

Wallet and payment lookups ran outside the transaction

• Fixed the scheduled run reading the wallet before opening its transaction, so another operation could change the balance in between. The wallet is now read and locked inside the transaction.
• Fixed the original debit being looked up outside the atomic scope in several handlers; those lookups now run inside their own transaction.
• Fixed the debit lookup matching on reference alone, which could match an unrelated payment sharing that reference. It now also matches on the investment payment type.

An admin edit could rewrite the amount or the owner

• Fixed the admin investment edit accepting a new amount or a new owner. Changing the amount left the record disagreeing with the wallet debit that funded it; changing the owner reassigned somebody else's investment. Both are now rejected — only the plan, duration, symbol, profit and result can be edited.

A plan could be bought with a duration it was never offered with

• Fixed investment creation accepting any valid plan alongside any valid duration without checking the two were configured together, so combinations that never existed could be bought. The pairing is now checked and refused if it does not exist.

The wallet type defaulted silently

• Fixed investment creation not requiring the wallet type, so a request that omitted it succeeded against a silent default. It is now required, preventing an investment being created against the wrong wallet.

The scheduled run mishandled invalid and orphaned investments

• Fixed the scheduled run paying out zero on an investment with a missing or zero amount and still marking it completed. Such an investment is now logged and skipped.
• Fixed an investment whose original debit cannot be found being left active and retried on every run. It is now marked rejected so it is excluded from future processing.

The investment list disagreed with the server

• Fixed a cancelled investment staying in the list under a cancelled label, when cancelling removes it on the server. It is now removed from the list.
• Fixed a newly created investment adding the server's confirmation message to the list instead of the investment. The list is now re-read from the server after creation.

The expected profit did not match the payout

• Fixed the expected-profit display being calculated from the plan's advertised profit percentage while payouts are calculated from the plan's configured default profit. The two can differ, so customers saw an estimate that did not match what they received. The display now uses the same figure the payout does, and the plan now also reports its default, minimum and maximum profit.

The balance came from the wrong wallet

• Fixed the investment form showing the balance of the traded currency instead of the pair currency that funds the investment.

Markets written with a slash would not parse

• Fixed the symbol parser handling only concatenated forms, so a market written as BTC/USDT failed to parse and fell back to a default pair. Both forms are now handled.