Audit my existing BlindPay integration for correctness, security, and resilience. Read the code, then produce a findings report; do not change code until I approve the findings.
Ground truth for the audit:
- https://blindpay.com/docs/llms.txt (read the pages relevant to the flows you find in my code)
- The OpenAPI spec: curl https://api.blindpay.com/doc
Audit checklist:
1. API key handling: keys only on the server, never in client bundles, logs, or version control; scoped per instance.
2. Quote lifecycle: every quote executed before its expires_at is read from the response (not hardcoded); a re-quote path exists for expiry failures; quotes are never reused across payment attempts; currency_type is used with the correct convention on payins (sender = fiat) versus payouts (sender = stablecoin).
3. Amounts: integer minor units everywhere, no floating point money math anywhere in the pipeline.
4. Webhook security: Svix signature verification over the raw body with constant-time comparison and timestamp tolerance; svix-id dedup; fast 2xx responses with async processing; no state driven by polling where a webhook event exists.
5. Idempotency and double-send protection: payouts and payins are keyed on my own payment IDs so a retry or crash cannot create a duplicate transfer; the ToS call uses a proper UUID idempotency_key.
6. Error and failure paths: rejected KYC (including compliance_request RFIs), failed and refunded payouts, expired quotes, and unsupported-country errors all have explicit handling, not just the happy path.
7. State and reconciliation: BlindPay IDs (re_, ba_, bw_, bl_, va_, qu_, po_, pi_, tr_) persisted against my records; a reconciliation job or report compares my ledger with BlindPay statuses.
8. Environment hygiene: no sentinel test amounts ($666.00/$777.00), USDB token, or testnet networks reachable from production configuration; webhook endpoints configured separately per instance.
For each finding report: severity (critical, high, medium, low), the file and line, what is wrong, the concrete failure it can cause, and the fix. Order by severity. Finish with the three fixes I should make first.