server/utils/ramps/bridge.ts (2)

422-429: ⚠️ Potential issue | 🟠 Major

Consult the fee window before creating a new rail.

These branches create the instruction first and only then read evaluateSponsoredFees(...). If the customer already exhausted sponsorship on another rail, the new account/address is still created fee-free, so the response can come back with fee: "0.0" while sponsoredFees.available is already 0.

Also applies to: 456-468

---

1148-1158: ⚠️ Potential issue | 🔴 Critical

Normalize volume before comparing it to a USD threshold.

This rule stores only a raw amount string, but it is fed from native-currency Bridge events and later surfaced as USD. Math.round(Number(event.amount)) * 100n also drops cent precision. That means fee activation can move materially on non-USD or fractional transfers.

Run this to confirm the rule has no currency context and currently rounds to whole dollars:

#!/bin/bash
rg -n -C2 'schema: object\(|symbol: "USD"|Math\.round\(Number\(event\.amount\)\) \* 100n' server/utils/ramps/bridge.ts
rg -n -C3 'feeRule\.report\(|initial_amount|outgoing_amount|currency:' server/hooks/bridge.ts
python - <<'PY'
import math
for amount in ["0.49", "0.50", "99.999", "200.01"]:
    cents = math.floor(float(amount) + 0.5) * 100
    print(f"{amount} -> current cents: {cents}")
PY

Expected: the grep output shows the window is labeled USD while the stored event has only amount, and the Python output shows current whole-dollar rounding.

server/utils/ramps/bridge.ts (1)

422-429: ⚠️ Potential issue | 🟠 Major

Seed newly created Bridge rails from the current fee-window state.

Both provisioning paths still create new rails with zero fees. If the customer already crossed the sponsored-fee threshold before their first ACH/WIRE/SEPA/SPEI/PIX-BR or crypto rail is created, /quote can return exhausted sponsoredFees while the freshly created rail still has fee: "0.0", and that rail stays free until a later trigger/expiry cycle updates it.

🛠️ fix sketch

+  const fee = await feeRule
+    .read(customer.id)
+    .then(({ result }) => (result.trigger ? fees[CurrencyToBridge[currency]] : "0.0"))
+    .catch(() => "0.0");
   virtualAccount ??= await createVirtualAccount(customer.id, {
     source: { currency: CurrencyToBridge[currency] },
-    developer_fee_percent: "0.0",
+    developer_fee_percent: fee,
     destination: { currency: "usdc", payment_rail: supportedChainId, address: account },
   });

Apply the same fee derivation to custom_developer_fee_percent when creating liquidation addresses, or have evaluateSponsoredFees() return the trigger state so both branches can reuse a single read.

Also applies to: 456-468