@@ -83,8 +83,43 @@ async function upsertAirdrop(event) {
     });
   }
 
-  await cache.set(airdropKey(airdropId), next);
-  await cache.getClient().sadd(AIRDROP_IDS_KEY, airdropId);
+  // Issue #354: a single MULTI/EXEC transaction instead of two separate
+  // round trips — a crash between them used to leave an airdrop record
+  // with no entry in AIRDROP_IDS_KEY (invisible to anything that scans the
+  // id set) or vice versa (an id with no backing record).
+  await cache.getClient().multi()
+    .set(airdropKey(airdropId), JSON.stringify(next))
+    .sadd(AIRDROP_IDS_KEY, airdropId)
+    .exec();
+}
+
+// Issue #353: recipients used to be stored as one JSON-list string per
+// airdrop, so every single-recipient upsert had to load the ENTIRE list
+// into memory (O(n) per event) just to update one entry. Each recipient is
+// now its own field in a Redis hash keyed by airdrop id, so an upsert is
+// one HGET + one HSET (O(1)), regardless of how many recipients the
+// airdrop has.
+//
+// A key that predates this fix still holds the old JSON-list string, and
+// HGET/HSET on a String-typed key raises WRONGTYPE — this migrates it,
+// once, lazily on first access, rather than requiring a manual operator
+// step before deploying.
+async function migrateRecipientsListToHashIfNeeded(key) {
+  const redis = cache.getClient();
+  const type = await redis.type(key);
+  if (type !== 'string') return;
+
+  const list = await getJsonList(key);
+  await redis.del(key);
+  if (list.length === 0) return;
+
+  const pipeline = redis.pipeline();
+  for (const entry of list) {
+    if (entry && entry.recipient) {
+      pipeline.hset(key, entry.recipient, JSON.stringify(entry));
+    }
+  }
+  await pipeline.exec();
 }
 
 async function upsertRecipient(event) {
@@ -93,9 +128,11 @@ async function upsertRecipient(event) {
   if (!airdropId || !recipient) return;
 
   const key = recipientsKey(airdropId);
-  const recipients = await getJsonList(key);
-  const existingIndex = recipients.findIndex((entry) => entry.recipient === recipient);
-  const existing = existingIndex >= 0 ? recipients[existingIndex] : { recipient };
+  await migrateRecipientsListToHashIfNeeded(key);
+
+  const redis = cache.getClient();
+  const existingRaw = await redis.hget(key, recipient);
+  const existing = existingRaw ? JSON.parse(existingRaw) : { recipient };
   const next = {
     ...existing,
     airdrop_id: airdropId,
@@ -115,10 +152,7 @@ async function upsertRecipient(event) {
     next.claimed_at = event.ledger_closed_at;
   }
 
-  if (existingIndex >= 0) recipients[existingIndex] = next;
-  else recipients.push(next);
-
-  await setJsonList(key, recipients);
+  await redis.hset(key, recipient, JSON.stringify(next));
 }
 
 async function appendClaim(event) {
@@ -142,8 +176,18 @@ async function appendClaim(event) {
 }
 
 async function saveEvent(event) {
-  await cache.set(eventKey(event.id), event);
-  await cache.getClient().sadd(EVENT_IDS_KEY, event.id);
+  // Issue #352: the raw event record and its id-set membership are written
+  // in one MULTI/EXEC transaction — a crash between them used to leave an
+  // event id in EVENT_IDS_KEY with no backing record, or a record with no
+  // id-set entry (invisible to getEventCount()). upsertAirdrop/
+  // upsertRecipient/appendClaim below each read-then-write their own
+  // separate keys (their prior values determine what gets written), so
+  // they can't join this same transaction — see #354 and #353 for their
+  // own atomicity/scalability fixes.
+  await cache.getClient().multi()
+    .set(eventKey(event.id), JSON.stringify(event))
+    .sadd(EVENT_IDS_KEY, event.id)
+    .exec();
   await upsertAirdrop(event);
   await upsertRecipient(event);
   await appendClaim(event);
@@ -191,7 +235,22 @@ async function getAirdropStatus(airdropId) {
 }
 
 async function getAirdropRecipients(airdropId) {
-  return getJsonList(recipientsKey(airdropId));
+  const key = recipientsKey(airdropId);
+  await migrateRecipientsListToHashIfNeeded(key);
+
+  const redis = cache.getClient();
+  const raw = await redis.hgetall(key);
+  const recipients = Object.values(raw).map((v) => JSON.parse(v));
+  // A hash has no guaranteed iteration order across calls; sort by
+  // added_ledger (falling back to recipient address) so pagination here
+  // stays stable, matching the old JSON-list's insertion order.
+  recipients.sort((a, b) => {
+    const la = a.added_ledger ?? 0;
+    const lb = b.added_ledger ?? 0;
+    if (la !== lb) return la - lb;
+    return String(a.recipient).localeCompare(String(b.recipient));
+  });
+  return recipients;
 }
 
 async function getRecipientClaims(address) {
 
@@ -85,15 +85,25 @@ async function create({ url, events, secret, description, filters, owner_ip }) {
     updated_at: now,
   };
   const redis = cache.getClient();
-  await cache.set(key(id), record);
-  // A sorted set scored by creation time, not a plain set — mirrors
-  // airdropsService/alerts.js's own IDS_KEY pattern, so paginating (added
-  // below) walks a deterministic, newest-first order rather than
-  // whatever arbitrary order SMEMBERS happened to return (#131).
-  await redis.zadd(IDS_KEY, Date.parse(now), id);
+  // Issue #355: one MULTI/EXEC transaction instead of two or three separate
+  // round trips — every value here is freshly computed above (no read of
+  // prior state feeds into any of these writes), so unlike the read-modify-
+  // write helpers in eventStore.js, this can go directly into one atomic
+  // batch. A crash mid-way used to leave a webhook record with no entry in
+  // IDS_KEY (invisible to list()/listAll(), so it would never fire), or an
+  // id in IDS_KEY with no backing record (a 404 from findById() that list()
+  // still returned as a phantom entry).
+  const multi = redis.multi()
+    .set(key(id), JSON.stringify(record))
+    // A sorted set scored by creation time, not a plain set — mirrors
+    // airdropsService/alerts.js's own IDS_KEY pattern, so paginating (added
+    // below) walks a deterministic, newest-first order rather than
+    // whatever arbitrary order SMEMBERS happened to return (#131).
+    .zadd(IDS_KEY, Date.parse(now), id);
   if (owner_ip) {
-    await redis.zadd(`webhooks:owner:${owner_ip}`, Date.parse(now), id);
+    multi.zadd(`webhooks:owner:${owner_ip}`, Date.parse(now), id);
   }
+  await multi.exec();
   return normalize(record);
 }
 
 
@@ -2,17 +2,20 @@
 
 /**
  * In-memory mock of the ioredis surface used by src/services/cache.js.
- * Covers strings (used by cache.get/set/del), SETs, sorted SETs, and LISTs.
+ * Covers strings (used by cache.get/set/del), SETs, sorted SETs, LISTs,
+ * and HASHes.
  */
 function createCacheMock() {
-  const store = new Map();
   const sets = new Map();
   const zsets = new Map();
   const lists = new Map();
+  const hashes = new Map();
   const counters = new Map();
-  // Separate raw string store (with per-key TTL) backing redis.set/get/del —
-  // distinct from `store` above, which backs the higher-level cacheMock.
-  // get/set JSON API with different key/value semantics.
+  // Raw string store (with per-key TTL) backing redis.set/get/del. Real
+  // Redis has exactly one string keyspace behind both the raw ioredis API
+  // and cache.js's JSON-serializing get/set/del wrapper — so both are
+  // implemented against this single Map (see cacheMock.get/set/del below),
+  // rather than each holding its own disconnected copy of the same key.
   const rawStore = new Map();
 
   function getSet(key) {
@@ -27,6 +30,10 @@ function createCacheMock() {
     if (!lists.has(key)) lists.set(key, []);
     return lists.get(key);
   }
+  function getHash(key) {
+    if (!hashes.has(key)) hashes.set(key, new Map());
+    return hashes.get(key);
+  }
   function isExpired(entry) {
     return entry.expiresAt !== null && Date.now() >= entry.expiresAt;
   }
@@ -36,6 +43,38 @@ function createCacheMock() {
     return entry;
   }
 
+  // Queues commands issued through redis.multi()/redis.pipeline() and
+  // replays them, in order, against the same redis.<command> mock
+  // functions on .exec() — so MULTI/EXEC and PIPELINE go through the exact
+  // same logic as calling each command directly, with no duplicated
+  // implementation to drift out of sync.
+  function makeChain() {
+    const queue = [];
+    const chain = {};
+    const proxy = new Proxy(chain, {
+      get(target, prop) {
+        if (prop === 'exec') {
+          return async () => {
+            const results = [];
+            for (const [cmd, args] of queue) {
+              try {
+                results.push([null, await redis[cmd](...args)]);
+              } catch (err) {
+                results.push([err, null]);
+              }
+            }
+            return results;
+          };
+        }
+        return (...args) => {
+          queue.push([prop, args]);
+          return proxy;
+        };
+      },
+    });
+    return proxy;
+  }
+
   const redis = {
     smembers: jest.fn(async (key) => [...(sets.get(key) || [])]),
     sadd: jest.fn(async (key, val) => { getSet(key).add(val); }),
@@ -113,19 +152,63 @@ function createCacheMock() {
       }
       if (nx && getLive(key)) return null;
       rawStore.set(key, { value: String(value), expiresAt: ttlMs !== null ? Date.now() + ttlMs : null });
+      hashes.delete(key);
+      sets.delete(key);
+      zsets.delete(key);
+      lists.delete(key);
       return 'OK';
     }),
     get: jest.fn(async (key) => {
       const entry = getLive(key);
       return entry ? entry.value : null;
     }),
-    del: jest.fn(async (key) => (rawStore.delete(key) ? 1 : 0)),
+    del: jest.fn(async (key) => {
+      const had = getLive(key) !== null || hashes.has(key) || sets.has(key) || zsets.has(key) || lists.has(key);
+      rawStore.delete(key);
+      hashes.delete(key);
+      sets.delete(key);
+      zsets.delete(key);
+      lists.delete(key);
+      return had ? 1 : 0;
+    }),
+    // Issue #353 (eventStore.js) uses these to store per-recipient fields
+    // instead of one JSON-list string per airdrop.
+    type: jest.fn(async (key) => {
+      if (getLive(key)) return 'string';
+      if (hashes.has(key) && hashes.get(key).size > 0) return 'hash';
+      if (sets.has(key) && sets.get(key).size > 0) return 'set';
+      if (zsets.has(key) && zsets.get(key).size > 0) return 'zset';
+      if (lists.has(key) && lists.get(key).length > 0) return 'list';
+      return 'none';
+    }),
+    hset: jest.fn(async (key, field, value) => {
+      const isNew = !getHash(key).has(field);
+      getHash(key).set(field, String(value));
+      return isNew ? 1 : 0;
+    }),
+    hget: jest.fn(async (key, field) => {
+      const h = hashes.get(key);
+      return h && h.has(field) ? h.get(field) : null;
+    }),
+    hgetall: jest.fn(async (key) => {
+      const h = hashes.get(key);
+      if (!h) return {};
+      return Object.fromEntries(h.entries());
+    }),
     pexpire: jest.fn(async (key, ms) => {
       const entry = getLive(key);
       if (!entry) return 0;
       entry.expiresAt = Date.now() + Number(ms);
       return 1;
     }),
+    // Issues #352/#354/#355: MULTI/EXEC — queues commands and replays them
+    // against the mock's own already-implemented methods on .exec(). Real
+    // MULTI/EXEC additionally guarantees no other client's commands can
+    // interleave between them; this mock only needs to prove the caller
+    // issues one .exec() covering all the intended writes; it does not
+    // model cross-client interleaving.
+    multi: jest.fn(() => makeChain()),
+    pipeline: jest.fn(() => makeChain()),
     // Mimics ioredis#defineCommand for the custom commands this codebase
     // registers (see deliveryRepository.js and leaderElection.js). Real
     // Redis runs the Lua body single-threaded to completion, so this mock
@@ -180,19 +263,45 @@ function createCacheMock() {
     getCommandQueueLength: () => 0,
     getConcurrencyStats: () => ({ active: 0, waiting: 0, available: 50, max: 50 }),
     get: jest.fn(async (key) => {
-      const v = store.get(key);
-      return v !== undefined ? JSON.parse(JSON.stringify(v)) : null;
+      const raw = await redis.get(key);
+      if (raw === null || raw === undefined) return null;
+      try {
+        return JSON.parse(raw);
+      } catch {
+        return null;
+      }
     }),
-    set: jest.fn(async (key, value) => { store.set(key, JSON.parse(JSON.stringify(value))); }),
-    del: jest.fn(async (key) => { store.delete(key); }),
+    set: jest.fn(async (key, value, ttlSeconds) => {
+      const serialized = JSON.stringify(value);
+      if (ttlSeconds) await redis.set(key, serialized, 'EX', ttlSeconds);
+      else await redis.set(key, serialized);
+    }),
+    del: jest.fn(async (key) => { await redis.del(key); }),
     disconnect: jest.fn(async () => {}),
   };
 
+  // Read-only view over rawStore, parsed, for tests that inspect the
+  // stored value directly rather than through cache.get() (e.g.
+  // webhookRepository.test.js's encryption-at-rest assertions). Backed by
+  // the same rawStore cache.set/get and raw redis.set/get share, so it
+  // sees a write made through either API.
+  const store = {
+    get(key) {
+      const entry = getLive(key);
+      if (!entry) return undefined;
+      try {
+        return JSON.parse(entry.value);
+      } catch {
+        return entry.value;
+      }
+    },
+  };
+
   function reset() {
-    store.clear();
     sets.clear();
     zsets.clear();
     lists.clear();
+    hashes.clear();
     counters.clear();
     rawStore.clear();
     Object.values(redis).forEach((fn) => fn.mockClear?.());
@@ -201,7 +310,7 @@ function createCacheMock() {
     cacheMock.del.mockClear();
   }
 
-  return { cacheMock, redis, store, sets, zsets, lists, counters, reset };
+  return { cacheMock, redis, store, sets, zsets, lists, hashes, counters, reset };
 }
 
 module.exports = { createCacheMock };