Issues

`/api/rpc` forwards to the upstream RPC without a timeout — one hung upstream request stalls its initiator AND every deduplicated waiter until the platform kills the invocation

#2522

· Bayyan16 opened

on Aug 16, 2026

`/api/auto-fund` consumes the 24h faucet claim before doing any work and only releases it on the happy path — any exception thrown after the gate locks the wallet out for a full day with nothing funded

#2521

· Bayyan16 opened

on Aug 16, 2026

`/api/devnet-register-mint` accepts fully unverified registrations — unauthenticated, unvalidated writes to the `devnet_mints` registry, with a latent poisoning chain that re-arms if `/api/devnet-mirror-mint` is ever re-wired

#2520

· Bayyan16 opened

on Aug 16, 2026

Residual Unchecked Solana Confirmation Results Create False-Success State in Devnet Routes

#2517

· Bayyan16 opened

on Aug 14, 2026

Regression: Create Market Preflight Omits Two Mandatory Backing Deposits

#2515

· Bayyan16 opened

on Aug 14, 2026

Sequential Launch Flow Can Report Success After Required Backing Top-Ups Fail

#2514

· Bayyan16 opened

on Aug 14, 2026

indexer-db reads are not network-isolated — every query omits the `network` predicate the Supabase path applies

#2513

· dcccrypto opened

on Aug 12, 2026

Trader stats silently truncate wallets above 10,000 trades and report partial history as totals

#2510

· Bayyan16 opened

on Aug 12, 2026

`/api/oracle/set-price-cap` treats malformed JSON as an all-market administrative operation

#2509

· Bayyan16 opened

on Aug 12, 2026

`hasInvisibleOrBidi()` misses in-scope bidi/invisible codepoints — the market `name` filter is bypassable (hardening follow-up to #2467)

#2506

· Bayyan16 opened

on Aug 10, 2026

[Security] `keeper-register` deployer signature does not bind registration parameters and is replayable

#2505

· Bayyan16 opened

on Aug 10, 2026

[SECURITY] Waitlist table has no server-side write authorization — anon insert WITH CHECK (true) bypasses signup route

#2503

· Bayyan16 opened

on Aug 10, 2026

Navigation Menu

All issues

`/api/rpc` forwards to the upstream RPC without a timeout — one hung upstream request stalls its initiator AND every deduplicated waiter until the platform kills the invocation

`/api/auto-fund` consumes the 24h faucet claim before doing any work and only releases it on the happy path — any exception thrown after the gate locks the wallet out for a full day with nothing funded

`/api/devnet-register-mint` accepts fully unverified registrations — unauthenticated, unvalidated writes to the `devnet_mints` registry, with a latent poisoning chain that re-arms if `/api/devnet-mirror-mint` is ever re-wired

Residual Unchecked Solana Confirmation Results Create False-Success State in Devnet Routes

Regression: Create Market Preflight Omits Two Mandatory Backing Deposits

Sequential Launch Flow Can Report Success After Required Backing Top-Ups Fail

indexer-db reads are not network-isolated — every query omits the `network` predicate the Supabase path applies

Trader stats silently truncate wallets above 10,000 trades and report partial history as totals

`/api/oracle/set-price-cap` treats malformed JSON as an all-market administrative operation

`hasInvisibleOrBidi()` misses in-scope bidi/invisible codepoints — the market `name` filter is bypassable (hardening follow-up to #2467)

[Security] `keeper-register` deployer signature does not bind registration parameters and is replayable

[SECURITY] Waitlist table has no server-side write authorization — anon insert WITH CHECK (true) bypasses signup route

Search results