fix: harden transaction signing with string-based USDC conversion and sell confirmation

- Replace float-based USDC atomic conversion with string-based usdcToAtomic()
- Add confirmTransaction after sendRawTransaction in sell flow
- Retain lastValidBlockHeight for proper transaction confirmation
- Cache devnet Connection as module-level singleton

Author: rz1989s

frontend/src/components/Widget.tsx

@@ -350,14 +350,18 @@ function DepositView({
         if (!signTransaction) {
           throw new Error('Wallet does not support transaction signing. Use manual deposit.');
         }
-        const { transaction, devnetConnection } = await buildSellTransaction(
+        const { transaction, devnetConnection, lastValidBlockHeight } = await buildSellTransaction(
           publicKey,
           order.deposit_address,
           (order as SellResponse).amount_sol,
           order.memo,
         );
         const signed = await signTransaction(transaction);
-        await devnetConnection.sendRawTransaction(signed.serialize());
+        const sig = await devnetConnection.sendRawTransaction(signed.serialize());
+        await devnetConnection.confirmTransaction(
+          { signature: sig, blockhash: transaction.recentBlockhash!, lastValidBlockHeight },
+          'confirmed',
+        );
       }
       setSent(true);
     } catch (err) {

frontend/src/lib/transactions.ts

@@ -15,6 +15,13 @@ const USDC_MINT = new PublicKey('EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v');
 const USDC_DECIMALS = 6;
 const MEMO_PROGRAM_ID = new PublicKey('MemoSq4gqABAXKb96qnH8TysNcWxMyWCqXgDLGmfcHr');
 
+function usdcToAtomic(amount: number): bigint {
+  const str = amount.toFixed(USDC_DECIMALS);
+  const [whole, frac = ''] = str.split('.');
+  const padded = frac.padEnd(USDC_DECIMALS, '0').slice(0, USDC_DECIMALS);
+  return BigInt(whole + padded);
+}
+
 function memoInstruction(memo: string, signer: PublicKey): TransactionInstruction {
   return new TransactionInstruction({
     keys: [{ pubkey: signer, isSigner: true, isWritable: false }],
@@ -37,7 +44,7 @@ export async function buildBuyTransaction(
   const recipientPubkey = new PublicKey(recipient);
   const senderAta = getAssociatedTokenAddressSync(USDC_MINT, sender);
   const recipientAta = getAssociatedTokenAddressSync(USDC_MINT, recipientPubkey);
-  const atomicAmount = BigInt(Math.round(usdcAmount * 10 ** USDC_DECIMALS));
+  const atomicAmount = usdcToAtomic(usdcAmount);
 
   const tx = new Transaction();
   tx.add(
@@ -59,19 +66,27 @@ export async function buildBuyTransaction(
 
 const DEVNET_RPC = import.meta.env.VITE_DEVNET_RPC || 'https://api.devnet.solana.com';
 
+let devnetConnection: Connection | null = null;
+function getDevnetConnection(): Connection {
+  if (!devnetConnection) {
+    devnetConnection = new Connection(DEVNET_RPC, 'confirmed');
+  }
+  return devnetConnection;
+}
+
 /**
  * Build a devnet SOL transfer transaction for the sell flow.
  * User sends devnet SOL to the treasury with a memo for order matching.
- * Returns both the transaction and devnet connection since the wallet adapter
- * is mainnet-only — we sign with the wallet then submit to devnet ourselves.
+ * Returns the transaction, devnet connection, and lastValidBlockHeight for confirmation.
+ * The wallet adapter is mainnet-only — we sign with the wallet then submit to devnet ourselves.
  */
 export async function buildSellTransaction(
   sender: PublicKey,
   recipient: string,
   solAmount: number,
   memo: string,
-): Promise<{ transaction: Transaction; devnetConnection: Connection }> {
-  const devnetConnection = new Connection(DEVNET_RPC, 'confirmed');
+): Promise<{ transaction: Transaction; devnetConnection: Connection; lastValidBlockHeight: number }> {
+  const conn = getDevnetConnection();
   const recipientPubkey = new PublicKey(recipient);
   const lamports = Math.round(solAmount * 1e9);
 
@@ -80,6 +95,7 @@ export async function buildSellTransaction(
   tx.add(memoInstruction(memo, sender));
 
   tx.feePayer = sender;
-  tx.recentBlockhash = (await devnetConnection.getLatestBlockhash()).blockhash;
-  return { transaction: tx, devnetConnection };
+  const { blockhash, lastValidBlockHeight } = await conn.getLatestBlockhash();
+  tx.recentBlockhash = blockhash;
+  return { transaction: tx, devnetConnection: conn, lastValidBlockHeight };
 }