This does not surprise me at all. We should proceed as-is, perhaps they only ever redirect here for successful payments, but it still would be a good idea for them to provide all the necessary signed params so we are able to create an order w/o having to depend on the async notification callback. Maybe a wish list item in our follow up conversations with them?