-
Notifications
You must be signed in to change notification settings - Fork 9
All issues
Issue creation is restricted in this repository
Issues
is:issue state:open
is:issue state:open
Search results
run_due_executions commits its FOR UPDATE SKIP LOCKED transaction before doing the work it's meant to protect, defeating the lock entirely
backendBackend service logicBackend service logicbugSomething isn't workingSomething isn't workingdatabaseDatabase/migrationsDatabase/migrationsGrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardIssue may be eligible for a GrantFox rewardOfficial Campaign | FWC26Campaign: Official Campaign | FWC26Campaign: Official Campaign | FWC26very hardVery difficult / senior-level bounty issueVery difficult / senior-level bounty issueStatus: Open.#31 In StellarSend/backend;EscrowService uses f64 for amount validation, risking precision loss on financial values
backendBackend service logicBackend service logicbugSomething isn't workingSomething isn't workingGrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardIssue may be eligible for a GrantFox rewardOfficial Campaign | FWC26Campaign: Official Campaign | FWC26Campaign: Official Campaign | FWC26very hardVery difficult / senior-level bounty issueVery difficult / senior-level bounty issueStatus: Open.#29 In StellarSend/backend;No reconciliation job for transactions stuck in 'pending' after a crash between broadcast and status update
backendBackend service logicBackend service logicGrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardIssue may be eligible for a GrantFox rewardOfficial Campaign | FWC26Campaign: Official Campaign | FWC26Campaign: Official Campaign | FWC26very hardVery difficult / senior-level bounty issueVery difficult / senior-level bounty issueStatus: Open.#28 In StellarSend/backend;EscrowService::list_for_user and SubscriptionService::list_for_user have no pagination, unlike transactions
backendBackend service logicBackend service logicbugSomething isn't workingSomething isn't workingdatabaseDatabase/migrationsDatabase/migrationsGrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardIssue may be eligible for a GrantFox rewardOfficial Campaign | FWC26Campaign: Official Campaign | FWC26Campaign: Official Campaign | FWC26very hardVery difficult / senior-level bounty issueVery difficult / senior-level bounty issueStatus: Open.#27 In StellarSend/backend;No JWT revocation mechanism — leaked or stale tokens remain valid for the full expiry window
backendBackend service logicBackend service logicGrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardIssue may be eligible for a GrantFox rewardOfficial Campaign | FWC26Campaign: Official Campaign | FWC26Campaign: Official Campaign | FWC26securitySecurity concernSecurity concernvery hardVery difficult / senior-level bounty issueVery difficult / senior-level bounty issueStatus: Open.#26 In StellarSend/backend;Keeper background job has no metrics, alerting, or observability into failure trends
backendBackend service logicBackend service logicdevopsDeployment/infraDeployment/infraGrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardIssue may be eligible for a GrantFox rewardOfficial Campaign | FWC26Campaign: Official Campaign | FWC26Campaign: Official Campaign | FWC26very hardVery difficult / senior-level bounty issueVery difficult / senior-level bounty issueStatus: Open.#25 In StellarSend/backend;CORS layer defaults to fully open (any origin/method/header) with no production guard
backendBackend service logicBackend service logicGrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardIssue may be eligible for a GrantFox rewardOfficial Campaign | FWC26Campaign: Official Campaign | FWC26Campaign: Official Campaign | FWC26securitySecurity concernSecurity concernvery hardVery difficult / senior-level bounty issueVery difficult / senior-level bounty issueStatus: Open.#24 In StellarSend/backend;Escrow/subscription on-chain id ScVal encoding is a placeholder that likely mismatches the real contract ABI
backendBackend service logicBackend service logicbugSomething isn't workingSomething isn't workingGrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardIssue may be eligible for a GrantFox rewardOfficial Campaign | FWC26Campaign: Official Campaign | FWC26Campaign: Official Campaign | FWC26very hardVery difficult / senior-level bounty issueVery difficult / senior-level bounty issueStatus: Open.#23 In StellarSend/backend;BatchPaymentService::execute_batch never validates signed_xdr contents match the claimed legs array
backendBackend service logicBackend service logicbugSomething isn't workingSomething isn't workingGrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardIssue may be eligible for a GrantFox rewardOfficial Campaign | FWC26Campaign: Official Campaign | FWC26Campaign: Official Campaign | FWC26securitySecurity concernSecurity concernvery hardVery difficult / senior-level bounty issueVery difficult / senior-level bounty issueStatus: Open.#22 In StellarSend/backend;POST /api/keeper/run-subscriptions has zero authentication, allowing anyone to trigger keeper fee spend
backendBackend service logicBackend service logicGrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardIssue may be eligible for a GrantFox rewardOfficial Campaign | FWC26Campaign: Official Campaign | FWC26Campaign: Official Campaign | FWC26securitySecurity concernSecurity concernvery hardVery difficult / senior-level bounty issueVery difficult / senior-level bounty issueStatus: Open.#21 In StellarSend/backend;src/services/rate_service.rs is a dead, misleading duplicate stub of the real RateService in rate.rs
backendBackend service logicBackend service logicbugSomething isn't workingSomething isn't workingGrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardIssue may be eligible for a GrantFox rewardOfficial Campaign | FWC26Campaign: Official Campaign | FWC26Campaign: Official Campaign | FWC26very hardVery difficult / senior-level bounty issueVery difficult / senior-level bounty issueStatus: Open.#20 In StellarSend/backend;No rate limiting on /api/auth/login enables credential-stuffing / brute force
backendBackend service logicBackend service logicsecuritySecurity concernSecurity concernvery hardVery difficult / senior-level bounty issueVery difficult / senior-level bounty issueStatus: Open.#18 In StellarSend/backend;