fix(backend): address transaction fraud, OOM sort, TOML passphrase, a… - #892
Merged
OlaGreat merged 1 commit intoJul 25, 2026
Merged
Conversation
…nd Sentry source maps Closes OlaGreat#794 — POST /support-transactions: recipientAddress ↔ walletAddress assertion Before this fix, the endpoint verified the Horizon transaction was real but never checked that the supplied recipientAddress matched the profile's stored walletAddress. An attacker could pay their own wallet, then POST with a victim's profileId; Horizon verification would pass and the victim's profile would accumulate fraudulent records, milestone progress, badge triggers, and webhook deliveries without ever receiving funds. Fix: after the existing profile-existence check, the query now also selects walletAddress and returns 400 ADDRESS_MISMATCH if it does not equal parsed.data.recipientAddress. Closes OlaGreat#790 — GET /profiles?sort=most_supported|most_transactions: cap in-memory load The sort-by-metrics branch fetched every profile with every SUCCESS transaction into Node.js memory before sorting and discarding all but the requested page — a DoS and OOM vector at scale (1 M+ rows with 10 k profiles × 100 txs each). Fix: add take: 1000 to the Prisma query to bound the worst-case memory footprint. Comment notes the long-term solution is a precomputed totalSupported/transactionCount column updated transactionally. Closes OlaGreat#788 — stellar.toml NETWORK_PASSPHRASE always emitted testnet value on mainnet The ternary compared process.env.STELLAR_NETWORK === 'MAINNET', but the actual mainnet value of that variable is 'PUBLIC'. The condition was always false in production, so /.well-known/stellar.toml always advertised the testnet passphrase. Stellar wallets and federation resolvers reading this TOML would fail to build valid mainnet transactions. Fix: change the comparison to === 'PUBLIC'. Closes OlaGreat#787 — CI: upload Sentry source maps after build for actionable production traces TypeScript is compiled to dist/*.js; without source maps uploaded to Sentry, production error traces point to minified/compiled line numbers rather than original src/*.ts lines. Fix: enable sourceMap: true in backend/tsconfig.json so the build emits .js.map files, then add a 'Upload source maps to Sentry' step to .github/workflows/backend.yml that runs only on pushes to main using npx @sentry/cli. Requires SENTRY_AUTH_TOKEN to be added to GitHub Actions secrets.
|
@flavor365 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
5 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
…nd Sentry source maps
Closes #794 — POST /support-transactions: recipientAddress ↔ walletAddress assertion Before this fix, the endpoint verified the Horizon transaction was real but never checked that the supplied recipientAddress matched the profile's stored walletAddress. An attacker could pay their own wallet, then POST with a victim's profileId; Horizon verification would pass and the victim's profile would accumulate fraudulent records, milestone progress, badge triggers, and webhook deliveries without ever receiving funds. Fix: after the existing profile-existence check, the query now also selects walletAddress and returns 400 ADDRESS_MISMATCH if it does not equal parsed.data.recipientAddress.
Closes #790 — GET /profiles?sort=most_supported|most_transactions: cap in-memory load The sort-by-metrics branch fetched every profile with every SUCCESS transaction into Node.js memory before sorting and discarding all but the requested page — a DoS and OOM vector at scale (1 M+ rows with 10 k profiles × 100 txs each). Fix: add take: 1000 to the Prisma query to bound the worst-case memory footprint. Comment notes the long-term solution is a precomputed totalSupported/transactionCount column updated transactionally.
Closes #788 — stellar.toml NETWORK_PASSPHRASE always emitted testnet value on mainnet The ternary compared process.env.STELLAR_NETWORK === 'MAINNET', but the actual mainnet value of that variable is 'PUBLIC'. The condition was always false in production, so /.well-known/stellar.toml always advertised the testnet passphrase. Stellar wallets and federation resolvers reading this TOML would fail to build valid mainnet transactions. Fix: change the comparison to === 'PUBLIC'.
Closes #787 — CI: upload Sentry source maps after build for actionable production traces TypeScript is compiled to dist/.js; without source maps uploaded to Sentry, production error traces point to minified/compiled line numbers rather than original src/.ts lines. Fix: enable sourceMap: true in backend/tsconfig.json so the build emits .js.map files, then add a 'Upload source maps to Sentry' step to .github/workflows/backend.yml that runs only on pushes to main using npx @sentry/cli. Requires SENTRY_AUTH_TOKEN to be added to GitHub Actions secrets.