# Common mistakes (/guides/common-mistakes)



<!-- generated from docs/wallet-api/QUICKSTART.md §12 — edit THAT file -->

1. **Parsing amounts as floats or JSON numbers.** They are strings. Always.
2. **Hardcoding 6 decimals.** USDT/USDC on BSC are 18.
3. **Re-serializing the body before HMAC.** Use the raw bytes.
4. **Trusting the payload before verifying the signature.** Verify first.
5. **Not deduping on `event.id`.** Delivery is at-least-once.
6. **Assuming event order.** Order on `sequence`.
7. **Treating `deposit.detected` as money.** Only `confirmed` is.
8. **Ignoring `deposit.orphaned`.** Reorgs are rare, not impossible, and unhandled they leave your ledger permanently wrong.
9. **Omitting the TON memo.** Funds sent without it cannot be attributed.
10. **Retrying a payout without an `Idempotency-Key`.** That is how you pay twice.
11. **Polling instead of subscribing.** Webhooks are immediate; polling burns your rate limit.
12. **Doing work before returning 2xx.** Ack, then process.