diff --git a/app/Http/Controllers/pay/WalletPaymentController.php b/app/Http/Controllers/pay/WalletPaymentController.php
index 8d6150d..280894a 100644
--- a/app/Http/Controllers/pay/WalletPaymentController.php
+++ b/app/Http/Controllers/pay/WalletPaymentController.php
@@ -133,8 +133,7 @@ class WalletPaymentController extends Controller
             ], 422);
         }
 
-        $synthetic = Request::create('/', 'GET', $payload);
-        $result = $gateway->handleReturn($synthetic);
+        $result = $gateway->handleReturnPayload($payload);
 
         if (!($result['ok'] ?? false)) {
             return response()->json([
diff --git a/app/Services/Payment/Gateways/MontifyPartnerGateway.php b/app/Services/Payment/Gateways/MontifyPartnerGateway.php
index 1b3df54..674645e 100644
--- a/app/Services/Payment/Gateways/MontifyPartnerGateway.php
+++ b/app/Services/Payment/Gateways/MontifyPartnerGateway.php
@@ -157,8 +157,16 @@ class MontifyPartnerGateway implements WalletPaymentGatewayInterface
 
     public function handleReturn(Request $request): array
     {
-        // query() آبجکت ParameterBag است؛ برای HMAC باید آرایهٔ string باشد
-        $query = $this->normalizeReturnQuery($request->query()->all());
+        return $this->handleReturnPayload($this->extractQueryArray($request));
+    }
+
+    /**
+     * @param  array<string, mixed>  $rawQuery
+     * @return array{ok: bool, withdraw: ?\App\Models\Withdraw, http_status?: int, message?: string}
+     */
+    public function handleReturnPayload(array $rawQuery): array
+    {
+        $query = $this->normalizeReturnQuery($rawQuery);
         $signer = $this->signer();
 
         if (!$signer->verifyReturnSignature($query)) {
@@ -206,6 +214,29 @@ class MontifyPartnerGateway implements WalletPaymentGatewayInterface
         ];
     }
 
+    /**
+     * استخراج امن پارامترهای query — بدون فرض ParameterBag یا array.
+     *
+     * @return array<string, mixed>
+     */
+    private function extractQueryArray(Request $request): array
+    {
+        // دسترسی مستقیم به bag همیشه ParameterBag است
+        if (isset($request->query) && is_object($request->query) && method_exists($request->query, 'all')) {
+            return $request->query->all();
+        }
+
+        $raw = $request->query();
+        if (is_array($raw)) {
+            return $raw;
+        }
+        if (is_object($raw) && method_exists($raw, 'all')) {
+            return $raw->all();
+        }
+
+        return [];
+    }
+
     /**
      * پارامترهای برگشت Montify باید همگی string باشند (طبق مستند).
      *