Build a Secure Closed-Loop P2P Trading Platform — Web, iOS, Android & Admin

We are looking for an experienced FinTech development team to build a production-ready, closed-loop P2P trading platform for Web, iOS, and Android. This project does NOT require blockchain, smart contracts, user crypto wallets, or on-chain transactions. The platform will use a USDT-referenced internal accounting unit, but all user balances and transactions will be recorded in a secure off-chain double-entry ledger. Normal users cannot deposit from or withdraw to external blockchain addresses. PROJECT COMPONENTS 1. User Platform - Responsive web application - iOS and Android applications, preferably using Flutter - User registration and login - KYC provider integration - SMS/OTP verification - Optional bank-account verification integration - P2P buy and sell orders - Exact, near-amount, and configurable partial matching - Dual acceptance before bank details are revealed - Buyer payment-marked flow - Seller receipt-confirmation flow - Cancellation, expiry, timeout, and dispute flows - Searchable transaction history - Downloadable transaction receipts - Evidence upload for disputes - Push, SMS, and in-app notifications 2. Secure Internal Ledger - Append-only double-entry ledger - Available, locked, bonus, partner, fee, and withdrawal-hold balances - Seller balance locking during active trades - Atomic settlement and reversal transactions - Idempotency protection - Prevention of double spending and duplicate settlement - Full audit trail for every balance change - Reconciliation, negative-balance, and ledger-mismatch alerts 3. Seller Program - Admin can convert a normal member into a seller - Seller eligibility, limits, and suspension controls - Seller levels based on completed trading volume - Separate buy and sell bonus rates - Configurable bonus policies by level - Bonus budget, cap, hold, release, and reversal controls - Detection of self-trading, related accounts, circular trading, and bonus abuse 4. Partner Functions - Only partner-to-member and member-to-partner internal transfers are permitted - Direct member-to-member transfer is prohibited - Configurable directional partner fee rates - Partner always pays the configured transfer fee - Partner balance and transaction history - Partner withdrawal request with fee calculation - Approval, rejection, hold, and manual external-settlement reference - The platform must never store or operate cold-wallet private keys 5. Back Offices - Separate partner back office - Separate super-admin back office - Member, seller, partner, KYC, transaction, dispute, and withdrawal management - Fee, bonus, level, timer, limit, and matching-policy configuration - Role-based access control - Maker-checker approval for sensitive operations - Risk and abnormal-transaction monitoring - Immutable administrator audit logs - Daily and monthly reports - Evidence package generation for bank, legal, or law-enforcement cooperation 6. Security Requirements Security and ledger integrity are the highest priorities. The implementation must include: - Server-authoritative balance and transaction processing - Strong database transaction and row-locking strategy - Secure session management, MFA, and step-up authentication - RBAC and tenant/partner data isolation - Encryption in transit and at rest - AWS Secrets Manager or equivalent - Rate limiting, bot protection, WAF, and DDoS protection - Protection against OWASP API and web vulnerabilities - Secure mobile storage using iOS Keychain and Android Keystore - SAST, dependency, secret, and container scanning - Backup, point-in-time recovery, monitoring, and disaster-recovery procedures - Penetration testing and remediation before production launch 7. Integrations - KYC/identity-verification provider - SMS/OTP provider - Push notifications - Email provider - Optional bank-account verification provider - REST APIs and webhooks - Compatibility adapter for an existing OneB partner API document IMPORTANT PRODUCT BOUNDARY This is a closed-loop internal platform. - No user blockchain wallet - No smart contract - No external user crypto deposit - No external user crypto withdrawal - No member-to-member free transfer - No platform custody of blockchain private keys - No representation that the internal unit is an actual Tether token or redeemable USDT DELIVERABLES - Complete backend source code - Web user application - Flutter iOS and Android applications - Partner back office - Super-admin back office - Database schema and migrations - API and webhook documentation - Infrastructure-as-Code and deployment pipeline - Automated tests - Security and penetration-test reports - App Store and Google Play submission support - Monitoring, backup, rollback, and disaster-recovery documentation - Full source-code and infrastructure ownership transferred to our company EXPECTED TEAM We prefer an established team or agency with: - At least two experienced backend developers - Web/frontend developer - Flutter mobile developer - QA engineer - Security or FinTech architecture experience - Previous experience with wallets, ledgers, exchanges, payment platforms, marketplaces, or P2P escrow systems Estimated production timeline: approximately 14–18 weeks, depending on team size and final integration requirements. WHEN APPLYING, PLEASE INCLUDE 1. Examples of FinTech, wallet, ledger, payment, exchange, or P2P systems you have built. 2. The exact team members who will work on this project. 3. Your proposed architecture and technology stack. 4. How you will prevent double spending, duplicate settlement, and unauthorized balance modification. 5. Your testing and security-verification plan. 6. A milestone-based timeline. 7. Confirmation that all cloud accounts, repositories, signing accounts, secrets, and production infrastructure will be owned by our company. 8. Confirmation that subcontracting requires prior written approval. Generic proposals without relevant FinTech or ledger experience will not be considered.