Blockchain Bug Bounty, deposit / withdrawal ERC20, ethers.js API

I have a Bug on my website https://rps.game - the hacker was able to call the below API unauthorised and thus was able to withdraw real money. If you can tell / help me how to secure, I can give you $200 or so:


http://router.post('/deposit_successed', auth, async (req, res) => {
try {
const {amount, txtHash} = req.body;
// validate the input
if (!amount || !txtHash) {
return res.status(400).send('Invalid input');
}
const tx = await provider.getTransaction(txtHash)

// Check if the transaction exists and is confirmed
if (!tx || !tx.blockNumber) {
return res.status(404).send('Transaction not found or not confirmed');
}
// Check if the transaction matches with the amount and the addresses
const signer = new ethers.Wallet(walletKey, provider);
const wamount = ethers.utils.parseUnits(amount, 'ether');
if (Number(tx.value) != Number(wamount) || http://tx.to !== signer.address) {
return res.status(400).send('Transaction does not match with input');
}
//req.user.balance = Number(req.user.balance) + Number(amount);
req.user.balance = await getWalletBalance(signer);
await http://req.user.save();
const newTransaction = new Transaction({
user: req.user,

amount: req.body.amount,
description: 'deposit'
});
await http://newTransaction.save();
const receipt = new Receipt({
user_id: req.user._id,
payment_method: req.body.payment_method,

payment_type: 'Deposit',
amount: req.body.amount
});
await http://receipt.save();
res.json({
success: true,
balance: req.user.balance,
newTransaction,
message: `Deposit successful! ? Much Wow.<br />View the transaction details on the blockchain using this <a href="https://etherscan.io/tx/${txtHash}" target="_blank">transaction link</a>.`
});
} catch (err) {
console.log('error in deposit_successed', err);
res.json({
success: false,
message: err
});
}
});