diff --git a/rc-service/rc-service-console/console-adapter/src/main/java/com/red/circle/console/adapter/integration/WithdrawalReviewIntegrationController.java b/rc-service/rc-service-console/console-adapter/src/main/java/com/red/circle/console/adapter/integration/WithdrawalReviewIntegrationController.java
index c9508f82..d7a29645 100644
--- a/rc-service/rc-service-console/console-adapter/src/main/java/com/red/circle/console/adapter/integration/WithdrawalReviewIntegrationController.java
+++ b/rc-service/rc-service-console/console-adapter/src/main/java/com/red/circle/console/adapter/integration/WithdrawalReviewIntegrationController.java
@@ -51,7 +51,10 @@ public class WithdrawalReviewIntegrationController {
     ResponseAssert.isTrue(ResponseErrorCode.REQUEST_PARAMETER_ERROR,
         "withdrawal approval credential is required",
         !"PASS".equals(request.getDecision())
-            || (request.getCredentialUrls() != null && !request.getCredentialUrls().isEmpty()));
+            || (request.getCredentialUrls() != null
+                && !request.getCredentialUrls().isEmpty()
+                && request.getCredentialUrls().stream()
+                .allMatch(url -> url != null && !url.isBlank())));
 
     long sourceApplicationId;
     try {
@@ -62,6 +65,9 @@ public class WithdrawalReviewIntegrationController {
       // failure 必然抛出 ResponseException；赋值只为满足 Java 的确定赋值检查。
       sourceApplicationId = 0L;
     }
+    // 来源申请号来自跨系统字符串契约；数值可解析不等于合法主键，必须在拿锁和查库前拦截非正数。
+    ResponseAssert.isTrue(ResponseErrorCode.REQUEST_PARAMETER_ERROR,
+        "invalid source withdrawal application id", sourceApplicationId > 0L);
     userBankBalanceBackService.approvalMoneyApply(new ApprovalMoneyApplyCmd()
         .setId(sourceApplicationId)
         .setCredential(request.getCredentialUrls())