diff --git a/docs/docs.go b/docs/docs.go
index cbb8e673..723e13f9 100644
--- a/docs/docs.go
+++ b/docs/docs.go
@@ -1565,6 +1565,18 @@ const docTemplate = `{
                         "schema": {
                             "$ref": "#/definitions/util.ResponseAny"
                         }
+                    },
+                    "429": {
+                        "description": "连续输入错误红包ID次数过多",
+                        "schema": {
+                            "$ref": "#/definitions/util.ResponseAny"
+                        },
+                        "headers": {
+                            "Retry-After": {
+                                "type": "integer",
+                                "description": "再次尝试前需等待的秒数"
+                            }
+                        }
                     }
                 }
             }
diff --git a/docs/swagger.json b/docs/swagger.json
index 003dc0fb..803d031a 100644
--- a/docs/swagger.json
+++ b/docs/swagger.json
@@ -1556,6 +1556,18 @@
                         "schema": {
                             "$ref": "#/definitions/util.ResponseAny"
                         }
+                    },
+                    "429": {
+                        "description": "连续输入错误红包ID次数过多",
+                        "schema": {
+                            "$ref": "#/definitions/util.ResponseAny"
+                        },
+                        "headers": {
+                            "Retry-After": {
+                                "type": "integer",
+                                "description": "再次尝试前需等待的秒数"
+                            }
+                        }
                     }
                 }
             }
diff --git a/docs/swagger.yaml b/docs/swagger.yaml
index f42a3d17..293554af 100644
--- a/docs/swagger.yaml
+++ b/docs/swagger.yaml
@@ -1578,6 +1578,14 @@ paths:
           description: OK
           schema:
             $ref: '#/definitions/util.ResponseAny'
+        "429":
+          description: 连续输入错误红包ID次数过多
+          headers:
+            Retry-After:
+              description: 再次尝试前需等待的秒数
+              type: integer
+          schema:
+            $ref: '#/definitions/util.ResponseAny'
       tags:
       - redenvelope
   /api/v1/redenvelope/covers:
diff --git a/frontend/components/common/redenvelope/red-envelope-card.tsx b/frontend/components/common/redenvelope/red-envelope-card.tsx
index b3903e49..eb1706dc 100644
--- a/frontend/components/common/redenvelope/red-envelope-card.tsx
+++ b/frontend/components/common/redenvelope/red-envelope-card.tsx
@@ -118,7 +118,7 @@ export function RedEnvelopeCard({
           animate={status === "opening" ? {
             scale: [1, 0.92, 0],
             opacity: [1, 0]
-          } : {}}
+          } : { scale: 1, opacity: 1 }}
           transition={status === "opening" ? {
             duration: 0.55,
             ease: "easeInOut"
diff --git a/frontend/components/common/redenvelope/red-envelope-share.tsx b/frontend/components/common/redenvelope/red-envelope-share.tsx
new file mode 100644
index 00000000..b4d87437
--- /dev/null
+++ b/frontend/components/common/redenvelope/red-envelope-share.tsx
@@ -0,0 +1,70 @@
+"use client"
+
+import { useState } from "react"
+import Image from "next/image"
+import { motion, useReducedMotion } from "motion/react"
+import { QRCodeSVG } from "qrcode.react"
+
+export function RedEnvelopeShare({ link }: { link: string }) {
+  const [playing, setPlaying] = useState(false)
+  const [replay, setReplay] = useState(0)
+  const reduceMotion = useReducedMotion()
+
+  return (
+    <>
+      <div className="-mt-2 flex justify-center py-1 md:hidden">
+        <div className="w-1/2 rounded-xl bg-white p-1 shadow-sm ring-1 ring-black/5 sm:p-2">
+          <QRCodeSVG value={link} size={224} marginSize={4} level="M" title="红包领取二维码" className="h-auto w-full" />
+        </div>
+      </div>
+      <div
+        className="relative mx-auto -mt-2 hidden w-fit grid-cols-[176px_90px] items-center gap-3 py-1 md:grid"
+        onPointerEnter={(event) => {
+          if (event.pointerType === "mouse") setPlaying(true)
+        }}
+        onPointerLeave={(event) => {
+          if (event.pointerType === "mouse") setPlaying(false)
+        }}
+        onFocus={() => setPlaying(true)}
+        onBlur={(event) => {
+          if (!event.currentTarget.contains(event.relatedTarget)) setPlaying(false)
+        }}
+      >
+        <motion.button
+          type="button"
+          aria-expanded={playing}
+          initial={false}
+          animate={{ x: playing ? 0 : 51 }}
+          transition={reduceMotion ? { duration: 0 } : { type: "spring", stiffness: 180, damping: 24 }}
+          className="relative z-10 aspect-square w-full rounded-xl bg-white p-1 shadow-sm ring-1 ring-black/5 outline-none focus-visible:ring-2 focus-visible:ring-red-500 sm:p-2"
+          onClick={() => {
+            setPlaying(true)
+            setReplay(value => value + 1)
+          }}
+        >
+          <QRCodeSVG value={link} size={224} marginSize={4} level="M" className="h-auto w-full" />
+        </motion.button>
+
+        <motion.div
+          initial={false}
+          animate={{ opacity: playing ? 1 : 0 }}
+          transition={{ duration: reduceMotion ? 0 : 0.3, delay: playing && !reduceMotion ? 0.15 : 0 }}
+          aria-hidden={!playing}
+          className="pointer-events-none relative h-44 min-w-0"
+        >
+          {playing && (
+            <Image
+              key={replay}
+              src="/red-envelope-scan.svg"
+              alt=""
+              width={128}
+              height={252}
+              unoptimized
+              className="absolute inset-0 h-full w-full"
+            />
+          )}
+        </motion.div>
+      </div>
+    </>
+  )
+}
diff --git a/frontend/components/common/trade/red-envelope.tsx b/frontend/components/common/trade/red-envelope.tsx
index f7527297..3aa4554c 100644
--- a/frontend/components/common/trade/red-envelope.tsx
+++ b/frontend/components/common/trade/red-envelope.tsx
@@ -4,7 +4,7 @@ import * as React from "react"
 import { useState, useEffect } from "react"
 import Image from "next/image"
 import { toast } from "sonner"
-import { Gift, Copy, Check, ExternalLink, Pencil, X, ImagePlus, History } from "lucide-react"
+import { Gift, Copy, Check, Share2, Pencil, X, ImagePlus, History } from "lucide-react"
 import type { UploadImageResponse } from "@/lib/services"
 import { getFileUrl } from "@/lib/services/upload/upload.service"
 import { Input } from "@/components/ui/input"
@@ -18,6 +18,7 @@ import { ListData } from "@/components/common/general/list-data"
 import { ImageCropper } from "@/components/common/redenvelope/image-cropper"
 import { motion } from "motion/react"
 import { RedEnvelopeCard } from "@/components/common/redenvelope/red-envelope-card"
+import { RedEnvelopeShare } from "@/components/common/redenvelope/red-envelope-share"
 import { useUser } from "@/contexts/user-context"
 import services from "@/lib/services"
 import type { RedEnvelopeType, CreateRedEnvelopeRequest, PublicConfigResponse, RedEnvelope, RedEnvelopeListResponse } from "@/lib/services"
@@ -696,7 +697,7 @@ export function RedEnvelope({ onSuccess }: { onSuccess?: () => void }) {
             </DialogDescription>
           </DialogHeader>
 
-          <div className="py-2">
+          <div className="pt-2">
             <div className="flex gap-2">
               <Input
                 value={resultLink}
@@ -713,13 +714,29 @@ export function RedEnvelope({ onSuccess }: { onSuccess?: () => void }) {
               <Button
                 variant="secondary"
                 size="sm"
-                onClick={() => window.open(resultLink, "_blank")}
+                aria-label="分享红包"
+                title="分享红包"
+                onClick={async () => {
+                  const shareData = { title: "领取红包", url: resultLink }
+                  if (!navigator.share || !navigator.canShare?.(shareData)) {
+                    window.open(resultLink, "_blank", "noopener,noreferrer")
+                    return
+                  }
+                  try {
+                    await navigator.share(shareData)
+                  } catch (error) {
+                    if (error instanceof Error && error.name === "AbortError") return
+                    toast.error("分享失败")
+                  }
+                }}
               >
-                <ExternalLink className="size-3" />
+                <Share2 className="size-3" />
               </Button>
             </div>
           </div>
 
+          {isResultOpen && resultLink && <RedEnvelopeShare link={resultLink} />}
+
           <div className="flex justify-end">
             <Button onClick={() => setIsResultOpen(false)} className="h-8 text-xs">
               完成
diff --git a/frontend/package.json b/frontend/package.json
index 91d5e732..9e877e75 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -53,6 +53,7 @@
     "next": "16.3.3",
     "next-themes": "^0.4.6",
     "pinyin-match": "^1.2.10",
+    "qrcode.react": "^4.2.0",
     "radix-ui": "^1.4.3",
     "react": "19.2.3",
     "react-day-picker": "^9.11.1",
diff --git a/frontend/pnpm-lock.yaml b/frontend/pnpm-lock.yaml
index d17f0cda..da0cdcf9 100644
--- a/frontend/pnpm-lock.yaml
+++ b/frontend/pnpm-lock.yaml
@@ -151,6 +151,9 @@ importers:
       pinyin-match:
         specifier: ^1.2.10
         version: 1.2.10
+      qrcode.react:
+        specifier: ^4.2.0
+        version: 4.2.0(react@19.2.3)
       radix-ui:
         specifier: ^1.4.3
         version: 1.4.3(@types/react-dom@19.2.2(@types/react@19.2.2))(@types/react@19.2.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)
@@ -3191,6 +3194,11 @@ packages:
     resolution: {integrity: sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==}
     engines: {node: '>=6'}
 
+  qrcode.react@4.2.0:
+    resolution: {integrity: sha512-QpgqWi8rD9DsS9EP3z7BT+5lY5SFhsqGjpgW5DY/i3mK4M9DTBNz3ErMi8BWYEfI3L0d8GIbGmcdFAS1uIRGjA==}
+    peerDependencies:
+      react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
+
   queue-microtask@1.2.3:
     resolution: {integrity: sha512-NuaNSa6flKT5JaSYQzJok04JzTL1CA6aGhv5rfLW3PgqA+M2ChpZQnAC8h8i4ZFkBS8X5RqkDBHA7r4hej3K9A==}
 
@@ -7007,6 +7015,10 @@ snapshots:
 
   punycode@2.3.1: {}
 
+  qrcode.react@4.2.0(react@19.2.3):
+    dependencies:
+      react: 19.2.3
+
   queue-microtask@1.2.3: {}
 
   radix-ui@1.4.3(@types/react-dom@19.2.2(@types/react@19.2.2))(@types/react@19.2.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3):
diff --git a/frontend/public/red-envelope-scan.svg b/frontend/public/red-envelope-scan.svg
new file mode 100644
index 00000000..16102e81
--- /dev/null
+++ b/frontend/public/red-envelope-scan.svg
@@ -0,0 +1,54 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="26 8 128 252" width="128" height="252" fill="none">
+  <title>手机扫码领取红包</title>
+  <style>
+    text { font-family: system-ui, sans-serif; }
+    .scanner { animation: hide 0.2s 2.4s forwards; }
+    .scan-line { opacity: 0; animation: scan 2s 0.4s forwards; }
+    .envelope, .check { opacity: 0; animation: reveal 0.3s 2.4s forwards; }
+    @keyframes hide { to { opacity: 0; } }
+    @keyframes reveal { to { opacity: 1; } }
+    @keyframes scan {
+      0% { opacity: 0; transform: translateY(0); }
+      10% { opacity: 1; transform: translateY(0); }
+      40% { opacity: 1; transform: translateY(57px); }
+      70% { opacity: 1; transform: translateY(0); }
+      100% { opacity: 0; transform: translateY(57px); }
+    }
+    @media (prefers-reduced-motion: reduce) {
+      .scanner, .scan-line { animation: none; opacity: 0; }
+      .envelope, .check { animation: none; opacity: 1; }
+    }
+  </style>
+  <rect x="28" y="8" width="124" height="252" rx="29" fill="#A1A1AA"/>
+  <rect x="30" y="10" width="120" height="248" rx="27" fill="#18181B"/>
+  <rect x="35" y="15" width="110" height="238" rx="23" fill="#F5F5F7"/>
+  <path d="M27 64v18m0 9v27m126-40v36" stroke="#71717A" stroke-width="2" stroke-linecap="round"/>
+  <g class="scanner">
+    <text x="90" y="65" text-anchor="middle" font-size="11" font-weight="600" fill="#27272A">扫一扫</text>
+    <rect x="45" y="86" width="90" height="104" rx="12" fill="#E4E4E7"/>
+    <g fill="#71717A">
+      <path fill-rule="evenodd" d="M65 111h17v17H65Zm4 4v9h9v-9ZM98 111h17v17H98Zm4 4v9h9v-9ZM65 144h17v17H65Zm4 4v9h9v-9Z"/>
+      <path d="M88 111h5v10h-5zm0 16h5v11H82v-5h6zm-23 6h11v5H65zm33 0h6v11h-6zm11 0h6v6h-6zm-21 11h5v17h-5zm10 6h17v5h-11v6h-6zm11-6h6v5h-6z"/>
+    </g>
+    <path d="M58 118v-14h14m36 0h14v14m0 36v14h-14m-36 0H58v-14" stroke="#EF5949" stroke-width="2.5" stroke-linecap="round"/>
+    <path class="scan-line" d="M61 107h58" stroke="#EF5949" stroke-width="2"/>
+    <text x="90" y="211" text-anchor="middle" font-size="8" fill="#71717A">将二维码放入框内</text>
+  </g>
+  <!-- 与 RedEnvelopeCard 保持相同的卡片比例、配色和 78% 开启按钮位置。 -->
+  <g class="envelope">
+    <rect x="50" y="72" width="80" height="133.25" rx="3" fill="#F25542"/>
+    <path d="M53 72h74q3 0 3 3v80.2q0 20.7-40 20.7t-40-20.7V75q0-3 3-3Z" fill="#E75240"/>
+    <path d="M50 155.2q0 20.7 40 20.7t40-20.7" stroke="#CC4939" stroke-opacity="0.5" stroke-width="0.5"/>
+    <rect x="74" y="100" width="8" height="8" rx="1.5" fill="#FAE5AE"/>
+    <text x="78" y="106" text-anchor="middle" font-size="4" fill="#E75240">你</text>
+    <text x="84" y="105.5" font-size="4" fill="#FAE5AE">你的红包</text>
+    <text x="90" y="117" text-anchor="middle" font-size="5" fill="#FAE5AE">恭喜发财，大吉大利</text>
+    <circle cx="90" cy="175.935" r="10" fill="#EFC77A"/>
+    <text x="90" y="178.5" text-anchor="middle" font-size="7.5" font-weight="700" fill="#4D4753" style="font-family: serif">開</text>
+  </g>
+  <rect x="64" y="23" width="52" height="15" rx="7.5" fill="#09090B"/>
+  <circle cx="107" cy="30.5" r="3" fill="#181C2A"/>
+  <circle cx="107" cy="30.5" r="1.2" fill="#334166"/>
+  <path class="check" d="m74 30 3 3 5-5" stroke="#86EFAC" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+  <rect x="70" y="243" width="40" height="3" rx="1.5" fill="#18181B" opacity="0.7"/>
+</svg>
diff --git a/internal/apps/dashboard/routers.go b/internal/apps/dashboard/routers.go
index 5ce3d457..92bec553 100644
--- a/internal/apps/dashboard/routers.go
+++ b/internal/apps/dashboard/routers.go
@@ -162,7 +162,7 @@ func GetUserBalanceStats(c *gin.Context) {
 	ctx := c.Request.Context()
 
 	var cachedStats UserBalanceStatsResponse
-	if err := db.GetJSON(ctx, dashboardCacheKeyPrefix, &cachedStats); err == nil {
+	if err := db.GetJSON(ctx, db.Redis, dashboardCacheKeyPrefix, &cachedStats); err == nil {
 		c.JSON(http.StatusOK, util.OK(cachedStats))
 		return
 	}
@@ -190,7 +190,7 @@ func GetUserBalanceStats(c *gin.Context) {
 	}
 
 	if cacheTTL, errGet := model.GetIntByKey(ctx, model.ConfigKeyUserBalanceStatsCacheTTL); errGet == nil && cacheTTL > 0 {
-		_ = db.SetJSON(ctx, dashboardCacheKeyPrefix, response, time.Duration(cacheTTL)*time.Second)
+		_ = db.SetJSON(ctx, db.Redis, dashboardCacheKeyPrefix, response, time.Duration(cacheTTL)*time.Second)
 	}
 
 	c.JSON(http.StatusOK, util.OK(response))
diff --git a/internal/apps/oauth/risk.go b/internal/apps/oauth/risk.go
index 5358a151..894d3876 100644
--- a/internal/apps/oauth/risk.go
+++ b/internal/apps/oauth/risk.go
@@ -77,9 +77,9 @@ func checkOpenAPIUserRisk(ctx context.Context, userID uint64) (*openAPIUserRiskR
 
 	cacheKey := fmt.Sprintf(openAPIRiskCacheKeyFormat, userID)
 	var cached openAPIUserRiskResponse
-	if err := db.GetJSON(ctx, cacheKey, &cached); err == nil {
+	if err := db.GetJSON(ctx, db.Redis, cacheKey, &cached); err == nil {
 		return &cached, true
-	} else if err != nil && !errors.Is(err, redis.Nil) {
+	} else if !errors.Is(err, redis.Nil) {
 		logger.ErrorF(ctx, "[OpenAPIRisk] read cache failed, skip risk check: %v", err)
 		return nil, false
 	}
@@ -90,7 +90,7 @@ func checkOpenAPIUserRisk(ctx context.Context, userID uint64) (*openAPIUserRiskR
 		return nil, false
 	}
 
-	if err := db.SetJSON(ctx, cacheKey, risk, openAPIRiskCacheTTL()); err != nil {
+	if err := db.SetJSON(ctx, db.Redis, cacheKey, risk, openAPIRiskCacheTTL()); err != nil {
 		logger.ErrorF(ctx, "[OpenAPIRisk] write cache failed, skip risk check: %v", err)
 		return nil, false
 	}
diff --git a/internal/apps/redenvelope/risk.go b/internal/apps/redenvelope/risk.go
new file mode 100644
index 00000000..792e6bff
--- /dev/null
+++ b/internal/apps/redenvelope/risk.go
@@ -0,0 +1,108 @@
+/*
+Copyright 2025 linux.do
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package redenvelope
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"strconv"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/linux-do/credit/internal/common"
+	"github.com/linux-do/credit/internal/db"
+	"github.com/linux-do/credit/internal/model"
+	"github.com/linux-do/credit/internal/util"
+)
+
+type claimRisk struct {
+	key      string
+	limit    int
+	cooldown int
+}
+
+func newClaimRisk(ctx context.Context, userID uint64) (*claimRisk, error) {
+	var limitConfig, cooldownConfig model.SystemConfig
+	if err := limitConfig.GetByKey(ctx, model.ConfigKeyRedEnvelopeClaimErrorLimit); err != nil {
+		return nil, err
+	}
+	if err := cooldownConfig.GetByKey(ctx, model.ConfigKeyRedEnvelopeClaimCooldownSeconds); err != nil {
+		return nil, err
+	}
+	limit, limitErr := strconv.Atoi(limitConfig.Value)
+	cooldown, cooldownErr := strconv.Atoi(cooldownConfig.Value)
+	if limitErr != nil || cooldownErr != nil || limit <= 0 || cooldown <= 0 || int64(cooldown) > int64((1<<63-1)/time.Second) {
+		return nil, nil
+	}
+	return &claimRisk{
+		key:      fmt.Sprintf("red_envelope:claim_risk:%d", userID),
+		limit:    limit,
+		cooldown: cooldown,
+	}, nil
+}
+
+type claimCooldownError struct {
+	seconds int64
+}
+
+func (e *claimCooldownError) Error() string {
+	return fmt.Sprintf(common.RedEnvelopeClaimCooldown, e.seconds)
+}
+
+func (r *claimRisk) update(ctx context.Context, outcome string) error {
+	if r == nil {
+		return nil
+	}
+	switch outcome {
+	case "check":
+		count, err := db.GetCounter(ctx, r.key)
+		if err != nil {
+			return err
+		}
+		if count < int64(r.limit) {
+			return nil
+		}
+		ttl, err := db.GetKeyTTL(ctx, r.key)
+		if err != nil {
+			return err
+		}
+		if ttl <= 0 {
+			return nil
+		}
+		return &claimCooldownError{seconds: int64((ttl-1)/time.Second) + 1}
+	case "invalid":
+		cooldown := time.Duration(r.cooldown) * time.Second
+		count, err := db.IncrementCounter(ctx, r.key, cooldown)
+		if err != nil {
+			return err
+		}
+		if count >= int64(r.limit) {
+			return &claimCooldownError{seconds: int64(r.cooldown)}
+		}
+	}
+	return nil
+}
+
+func respondClaimRiskError(c *gin.Context, err error) {
+	if cooldown, ok := err.(*claimCooldownError); ok {
+		c.Header("Retry-After", strconv.FormatInt(cooldown.seconds, 10))
+		c.JSON(http.StatusTooManyRequests, util.Err(cooldown.Error()))
+		return
+	}
+	c.JSON(http.StatusInternalServerError, util.Err(err.Error()))
+}
diff --git a/internal/apps/redenvelope/routers.go b/internal/apps/redenvelope/routers.go
index 2a258bc1..9b7d9215 100644
--- a/internal/apps/redenvelope/routers.go
+++ b/internal/apps/redenvelope/routers.go
@@ -302,15 +302,26 @@ func Create(c *gin.Context) {
 // @Produce json
 // @Param request body ClaimRequest true "领取红包请求"
 // @Success 200 {object} util.ResponseAny
+// @Failure 429 {object} util.ResponseAny "连续输入错误红包ID次数过多"
+// @Header 429 {integer} Retry-After "再次尝试前需等待的秒数"
 // @Router /api/v1/redenvelope/claim [post]
 func Claim(c *gin.Context) {
+	currentUser, _ := util.GetFromContext[*model.User](c, oauth.UserObjKey)
+	risk, err := newClaimRisk(c.Request.Context(), currentUser.ID)
+	if err != nil {
+		respondClaimRiskError(c, err)
+		return
+	}
+
 	var req ClaimRequest
 	if err := c.ShouldBindJSON(&req); err != nil {
 		c.JSON(http.StatusBadRequest, util.Err(err.Error()))
 		return
 	}
-
-	currentUser, _ := util.GetFromContext[*model.User](c, oauth.UserObjKey)
+	if err := risk.update(c.Request.Context(), "check"); err != nil {
+		respondClaimRiskError(c, err)
+		return
+	}
 
 	var claimedAmount decimal.Decimal
 	var redEnvelope model.RedEnvelope
@@ -320,6 +331,9 @@ func Claim(c *gin.Context) {
 		if err := tx.Clauses(clause.Locking{Strength: "UPDATE", Options: "NOWAIT"}).
 			Where("id = ?", req.ID).First(&redEnvelope).Error; err != nil {
 			if errors.Is(err, gorm.ErrRecordNotFound) {
+				if riskErr := risk.update(c.Request.Context(), "invalid"); riskErr != nil {
+					return riskErr
+				}
 				return errors.New(RedEnvelopeNotFound)
 			}
 			// 捕获锁等待超时错误，返回友好提示
@@ -413,6 +427,11 @@ func Claim(c *gin.Context) {
 
 		return tx.Create(&order).Error
 	}); err != nil {
+		var cooldown *claimCooldownError
+		if errors.As(err, &cooldown) {
+			respondClaimRiskError(c, cooldown)
+			return
+		}
 		errMsg := err.Error()
 		switch errMsg {
 		case RedEnvelopeNotFound:
diff --git a/internal/common/errs.go b/internal/common/errs.go
index 8d4c2c37..3b6e2b41 100644
--- a/internal/common/errs.go
+++ b/internal/common/errs.go
@@ -34,6 +34,7 @@ const (
 	RedEnvelopeDailyLimitExceeded = "今日发红包数量已达上限"
 	RedEnvelopeRecipientsExceeded = "红包个数超过最大可领取人数上限"
 	RedEnvelopeMinAmountRequired  = "红包总金额不能低于1LDC"
+	RedEnvelopeClaimCooldown      = "连续输入错误红包ID次数过多，已暂停领取，请在%d秒后重试"
 )
 
 const (
diff --git a/internal/db/migrator/migrator.go b/internal/db/migrator/migrator.go
index 0991c26e..e52f8538 100644
--- a/internal/db/migrator/migrator.go
+++ b/internal/db/migrator/migrator.go
@@ -126,6 +126,16 @@ func initSystemConfigs() {
 			Value:       "10000",
 			Description: "每个红包的最大可领取人数上限",
 		},
+		{
+			Key:         model.ConfigKeyRedEnvelopeClaimErrorLimit,
+			Value:       "5",
+			Description: "红包领取连续错误次数上限",
+		},
+		{
+			Key:         model.ConfigKeyRedEnvelopeClaimCooldownSeconds,
+			Value:       "900",
+			Description: "红包领取冷却时间（秒）",
+		},
 		{
 			Key:         model.ConfigKeyUserBalanceStatsCacheTTL,
 			Value:       "600",
diff --git a/internal/db/redis.go b/internal/db/redis.go
index 2719215e..43163c10 100644
--- a/internal/db/redis.go
+++ b/internal/db/redis.go
@@ -19,6 +19,7 @@ package db
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"log"
 	"strings"
@@ -148,10 +149,11 @@ func HGetJSON[T any](ctx context.Context, hashKey, fieldKey string, data *T) err
 
 // GetJSON 从Redis获取数据并反序列化为泛型类型
 // ctx: 上下文
+// client: Redis客户端或事务客户端
 // key: Redis key
 // data: 用于接收数据的指针（泛型）
-func GetJSON[T any](ctx context.Context, key string, data *T) error {
-	val, err := Redis.Get(ctx, PrefixedKey(key)).Bytes()
+func GetJSON[T any](ctx context.Context, client redis.Cmdable, key string, data *T) error {
+	val, err := client.Get(ctx, PrefixedKey(key)).Bytes()
 	if err != nil {
 		return err
 	}
@@ -165,18 +167,88 @@ func GetJSON[T any](ctx context.Context, key string, data *T) error {
 
 // SetJSON 将泛型数据序列化为JSON并设置到Redis
 // ctx: 上下文
+// client: Redis客户端或事务管道
 // key: Redis key
 // data: 要存储的数据（泛型）
 // expiration: 过期时间
-func SetJSON[T any](ctx context.Context, key string, data T, expiration time.Duration) error {
+func SetJSON[T any](ctx context.Context, client redis.Cmdable, key string, data T, expiration time.Duration) error {
 	jsonData, err := json.Marshal(data)
 	if err != nil {
 		return fmt.Errorf("failed to marshal data: %w", err)
 	}
 
-	if err := Redis.Set(ctx, PrefixedKey(key), jsonData, expiration).Err(); err != nil {
+	if err := client.Set(ctx, PrefixedKey(key), jsonData, expiration).Err(); err != nil {
 		return fmt.Errorf("failed to set redis key: %w", err)
 	}
 
 	return nil
 }
+
+// GetCounter 获取 Redis 中的整数计数。
+// key: Redis key，函数内部会自动添加配置的 key 前缀。
+// key 不存在时返回 0。
+func GetCounter(ctx context.Context, key string) (int64, error) {
+	count, err := Redis.Get(ctx, PrefixedKey(key)).Int64()
+	if errors.Is(err, redis.Nil) {
+		return 0, nil
+	}
+	return count, err
+}
+
+// GetKeyTTL 获取 Redis key 的剩余有效期。
+// key: Redis key，函数内部会自动添加配置的 key 前缀。
+// 返回值为正数时表示剩余有效期，redis -1 表示永不过期，redis -2 表示 key 不存在。
+func GetKeyTTL(ctx context.Context, key string) (time.Duration, error) {
+	return Redis.TTL(ctx, PrefixedKey(key)).Result()
+}
+
+// IncrementCounter 原子增加 Redis 中的整数计数并更新过期时间。
+// key: Redis key，函数内部会自动添加配置的 key 前缀。
+// expiration: 计数 key 的过期时间。
+// 返回值为自增后的计数。
+func IncrementCounter(ctx context.Context, key string, expiration time.Duration) (int64, error) {
+	var count *redis.IntCmd
+	_, err := Redis.TxPipelined(ctx, func(pipe redis.Pipeliner) error {
+		count = pipe.Incr(ctx, PrefixedKey(key))
+		pipe.Expire(ctx, PrefixedKey(key), expiration)
+		return nil
+	})
+	if err != nil {
+		return 0, err
+	}
+	return count.Result()
+}
+
+// DeleteKey 删除 Redis key。
+// key: Redis key，函数内部会自动添加配置的 key 前缀。
+func DeleteKey(ctx context.Context, key string) error {
+	return Redis.Del(ctx, PrefixedKey(key)).Err()
+}
+
+// UpdateJSON 通过事务原子读取并更新Redis中的JSON数据
+// ctx: 上下文
+// key: Redis key
+// update: 更新回调，接收数据指针（key不存在时为零值），返回过期时间、是否写入和错误
+// expiration: 过期时间，0表示不过期，负数表示删除key
+// write: 是否写入，false表示保持原值和过期时间不变
+// err: 回调返回错误时取消更新，并发修改导致事务冲突时返回redis.TxFailedErr
+func UpdateJSON[T any](ctx context.Context, key string, update func(*T) (expiration time.Duration, write bool, err error)) error {
+	return Redis.Watch(ctx, func(tx *redis.Tx) error {
+		var data T
+		if err := GetJSON(ctx, tx, key, &data); err != nil && !errors.Is(err, redis.Nil) {
+			return err
+		}
+		expiration, write, err := update(&data)
+		if err != nil || !write {
+			return err
+		}
+		_, err = tx.TxPipelined(ctx, func(pipe redis.Pipeliner) error {
+			if expiration < 0 {
+				pipe.Del(ctx, PrefixedKey(key))
+				return nil
+			}
+			return SetJSON(ctx, pipe, key, data, expiration)
+		})
+		return err
+	}, PrefixedKey(key))
+}
diff --git a/internal/model/system_configs.go b/internal/model/system_configs.go
index bbc43693..387ff350 100644
--- a/internal/model/system_configs.go
+++ b/internal/model/system_configs.go
@@ -32,21 +32,23 @@ import (
 
 // 配置键常量 - 所有系统配置的 key 定义
 const (
-	ConfigKeyMerchantOrderExpireMinutes = "merchant_order_expire_minutes" // 商家订单过期时间（分钟）
-	ConfigKeyWebsiteOrderExpireMinutes  = "website_order_expire_minutes"  // 网站订单过期时间（分钟）
-	ConfigKeyDisputeTimeWindowHours     = "dispute_time_window_hours"     // 商家争议时间窗口（小时）
-	ConfigKeyNewUserInitialCredit       = "new_user_initial_credit"       // 新用户注册初始积分
-	ConfigKeyNewUserProtectionDays      = "new_user_protection_days"      // 新用户保护期天数（期内不扣分）
-	ConfigKeyLeaderboardCacheTTLSeconds = "leaderboard_cache_ttl_seconds" // 排行榜缓存过期时间（秒）
-	ConfigKeyRedEnvelopeEnabled         = "red_envelope_enabled"          // 红包功能是否启用（1启用，0禁用）
-	ConfigKeyRedEnvelopeMaxAmount       = "red_envelope_max_amount"       // 单个红包的最大积分上限
-	ConfigKeyRedEnvelopeDailyLimit      = "red_envelope_daily_limit"      // 每日发红包的个数限制
-	ConfigKeyRedEnvelopeFeeRate         = "red_envelope_fee_rate"         // 红包手续费率（0-1之间的小数，0表示不收费）
-	ConfigKeyRedEnvelopeMaxRecipients   = "red_envelope_max_recipients"   // 每个红包的最大可领取人数上限
-	ConfigKeyUserBalanceStatsCacheTTL   = "user_balance_stats_cache_ttl"  // 用户余额统计缓存过期时间（秒)
-	ConfigKeyUploadAllowedExtensions    = "upload_allowed_extensions"     // 允许上传的文件扩展名，逗号分隔
-	ConfigKeySettlementDelayDaysMin     = "settlement_delay_days_min"     // 商户收款延迟到账最小天数（0表示即时到账）
-	ConfigKeySettlementDelayDaysMax     = "settlement_delay_days_max"     // 商户收款延迟到账最大天数（实际天数在min~max随机）
+	ConfigKeyMerchantOrderExpireMinutes      = "merchant_order_expire_minutes"       // 商家订单过期时间（分钟）
+	ConfigKeyWebsiteOrderExpireMinutes       = "website_order_expire_minutes"        // 网站订单过期时间（分钟）
+	ConfigKeyDisputeTimeWindowHours          = "dispute_time_window_hours"           // 商家争议时间窗口（小时）
+	ConfigKeyNewUserInitialCredit            = "new_user_initial_credit"             // 新用户注册初始积分
+	ConfigKeyNewUserProtectionDays           = "new_user_protection_days"            // 新用户保护期天数（期内不扣分）
+	ConfigKeyLeaderboardCacheTTLSeconds      = "leaderboard_cache_ttl_seconds"       // 排行榜缓存过期时间（秒）
+	ConfigKeyRedEnvelopeEnabled              = "red_envelope_enabled"                // 红包功能是否启用（1启用，0禁用）
+	ConfigKeyRedEnvelopeMaxAmount            = "red_envelope_max_amount"             // 单个红包的最大积分上限
+	ConfigKeyRedEnvelopeDailyLimit           = "red_envelope_daily_limit"            // 每日发红包的个数限制
+	ConfigKeyRedEnvelopeFeeRate              = "red_envelope_fee_rate"               // 红包手续费率（0-1之间的小数，0表示不收费）
+	ConfigKeyRedEnvelopeMaxRecipients        = "red_envelope_max_recipients"         // 每个红包的最大可领取人数上限
+	ConfigKeyRedEnvelopeClaimErrorLimit      = "red_envelope_claim_error_limit"      // 红包领取连续错误次数上限
+	ConfigKeyRedEnvelopeClaimCooldownSeconds = "red_envelope_claim_cooldown_seconds" // 红包领取冷却时间（秒）
+	ConfigKeyUserBalanceStatsCacheTTL        = "user_balance_stats_cache_ttl"        // 用户余额统计缓存过期时间（秒)
+	ConfigKeyUploadAllowedExtensions         = "upload_allowed_extensions"           // 允许上传的文件扩展名，逗号分隔
+	ConfigKeySettlementDelayDaysMin          = "settlement_delay_days_min"           // 商户收款延迟到账最小天数（0表示即时到账）
+	ConfigKeySettlementDelayDaysMax          = "settlement_delay_days_max"           // 商户收款延迟到账最大天数（实际天数在min~max随机）
 )
 
 const (