Issues

• No down/rollback migrations exist — migration 010's enum ADD VALUE is not even revertible in Postgres

  databasedevopsGrantFox OSSMaybe RewardedOfficial Campaign | FWC26Third Campaignvery hard
  StellarSend/backend#58 · Filter by author abayomicornelius opened on Aug 15, 2026
  2

  

• TransactionListParams.page has no upper bound — (page - 1) * per_page can overflow u32 (panic in debug, silent wraparound in release)

  backendbugGrantFox OSSMaybe RewardedOfficial Campaign | FWC26Third Campaignvery hard
  StellarSend/backend#57 · Filter by author abayomicornelius opened on Aug 15, 2026
  2

  

• register has a check-then-insert email race whose loser gets a 500 instead of 409, unlike batch.rs's unique-violation handling

  backendbugGrantFox OSSMaybe RewardedOfficial Campaign | FWC26Third Campaignvery hard
  StellarSend/backend#55 · Filter by author abayomicornelius opened on Aug 15, 2026
  5

• Three declared dependencies (validator, once_cell, base64) are completely unused in the real source tree

  backenddevopsGrantFox OSSMaybe RewardedOfficial Campaign | FWC26Third Campaignvery hard
  StellarSend/backend#52 · Filter by author abayomicornelius opened on Aug 15, 2026
  2

  

• interval_seconds near i64::MAX panics chrono::Duration::seconds() in SubscriptionService::create and run_due_executions

  backendbugGrantFox OSSMaybe RewardedOfficial Campaign | FWC26Third Campaignvery hard
  StellarSend/backend#51 · Filter by author abayomicornelius opened on Aug 15, 2026
  3

  

• payment_requests.memo has no length validation against Stellar's 28-byte on-chain MEMO_TEXT limit

  backendbugGrantFox OSSMaybe RewardedOfficial Campaign | FWC26Third Campaignvery hard
  StellarSend/backend#49 · Filter by author abayomicornelius opened on Aug 15, 2026
  5

• idx_escrows_beneficiary_account and idx_escrows_unlock_due are dead indices — no code lets a beneficiary/arbiter discover their escrows

  databaseenhancementGrantFox OSSMaybe RewardedOfficial Campaign | FWC26Third Campaignvery hard
  StellarSend/backend#48 · Filter by author abayomicornelius opened on Aug 15, 2026
  3

• No minimum bound on subscriptions.interval_seconds lets the keeper drain a payer's on-chain allowance every poll cycle

  backendbugGrantFox OSSMaybe RewardedOfficial Campaign | FWC26Third Campaignvery hard
  StellarSend/backend#47 · Filter by author abayomicornelius opened on Aug 15, 2026
  2

• A crash between claiming the batch hash and committing leg rows permanently orphans a batch payment, invisible to reconciliation

  backendbugdatabaseGrantFox OSSMaybe RewardedOfficial Campaign | FWC26Third Campaignvery hard
  StellarSend/backend#46 · Filter by author abayomicornelius opened on Aug 15, 2026
  2

• SorobanService::invoke_contract_via_keeper has no sequence-number reservation — concurrent keeper passes race on the shared keeper account

  backendbugGrantFox OSSMaybe RewardedOfficial Campaign | FWC26Third Campaignvery hard
  StellarSend/backend#45 · Filter by author abayomicornelius opened on Aug 15, 2026
  2

• PaymentService (get_quote + execute_send, the primary money-movement path) has zero test coverage

  backendGrantFox OSSMaybe RewardedOfficial Campaign | FWC26testingThird Campaignvery hard
  StellarSend/backend#44 · Filter by author abayomicornelius opened on Aug 15, 2026
  2

• middleware/auth.rs (JWT issuance and validation) has zero test coverage despite gating every authenticated endpoint

  GrantFox OSSMaybe RewardedOfficial Campaign | FWC26securitytestingThird Campaignvery hard
  StellarSend/backend#43 · Filter by author abayomicornelius opened on Aug 15, 2026
  2

• ReconciliationService has no terminal give-up state — a hash Horizon never saw stays 'pending' and gets re-checked forever

  backendbugGrantFox OSSMaybe RewardedOfficial Campaign | FWC26Third Campaignvery hard
  StellarSend/backend#42 · Filter by author abayomicornelius opened on Aug 15, 2026
  2

• ReconciliationService orders its stuck-transaction sweep by stellar_tx_hash instead of staleness, risking permanent starvation once the backlog exceeds the batch limit

  backendbugdatabaseGrantFox OSSMaybe RewardedOfficial Campaign | FWC26Third Campaignvery hard
  StellarSend/backend#41 · Filter by author abayomicornelius opened on Aug 15, 2026
  2

• EscrowService::submit_signed_action never re-checks escrow.status or authorization before finalizing release/refund, unlike build_action_tx

  backendbugGrantFox OSSMaybe RewardedOfficial Campaign | FWC26securityThird Campaignvery hard
  StellarSend/backend#40 · Filter by author abayomicornelius opened on Aug 15, 2026
  1

• migrations/004_add_webhooks.sql creates a live webhooks table (with a plaintext secret column) that no route or service ever uses

  bugdatabaseGrantFox OSSMaybe RewardedOfficial Campaign | FWC26Third Campaignvery hard
  StellarSend/backend#39 · Filter by author abayomicornelius opened on Aug 15, 2026
  1

• Login has a bcrypt timing side-channel that lets attackers enumerate registered emails

  bugGrantFox OSSMaybe RewardedOfficial Campaign | FWC26securityThird Campaignvery hard
  StellarSend/backend#38 · Filter by author abayomicornelius opened on Aug 15, 2026
  2

• fulfill_payment_request has no authentication and never verifies the claimed tx_hash on-chain — anyone can fake a payment as fulfilled

  backendbugGrantFox OSSMaybe RewardedOfficial Campaign | FWC26securityThird Campaignvery hard
  StellarSend/backend#37 · Filter by author abayomicornelius opened on Aug 15, 2026
  1

• GET /api/rates builds a brand-new RateService (and empty cache) on every request — the RATE_CACHE_TTL_SECS cache is dead code

  backendbugGrantFox OSSMaybe RewardedOfficial Campaign | FWC26Third Campaignvery hard
  StellarSend/backend#36 · Filter by author abayomicornelius opened on Aug 15, 2026
  3

• PaymentService::execute_send has no duplicate-submission guard, unlike BatchPaymentService after #30

  backendbugGrantFox OSSMaybe RewardedOfficial Campaign | FWC26Third Campaignvery hard
  StellarSend/backend#35 · Filter by author abayomicornelius opened on Aug 15, 2026
  2

  

• Soroban keeper/escrow submissions are marked Completed/Released/Refunded on sendTransaction's PENDING response — getTransaction is never polled

  backendbugGrantFox OSSMaybe RewardedOfficial Campaign | FWC26securityThird Campaignvery hard
  StellarSend/backend#34 · Filter by author abayomicornelius opened on Aug 15, 2026
  1

• run_due_executions commits its FOR UPDATE SKIP LOCKED transaction before doing the work it's meant to protect, defeating the lock entirely

  backendbugdatabaseGrantFox OSSMaybe RewardedOfficial Campaign | FWC26very hard
  StellarSend/backend#31 · Filter by author abayomicornelius opened on Jul 15, 2026
  2

• EscrowService uses f64 for amount validation, risking precision loss on financial values

  backendbugGrantFox OSSMaybe RewardedOfficial Campaign | FWC26very hard
  StellarSend/backend#29 · Filter by author abayomicornelius opened on Jul 15, 2026
  2

• No reconciliation job for transactions stuck in 'pending' after a crash between broadcast and status update

  backendGrantFox OSSMaybe RewardedOfficial Campaign | FWC26very hard
  StellarSend/backend#28 · Filter by author abayomicornelius opened on Jul 15, 2026
  2

• EscrowService::list_for_user and SubscriptionService::list_for_user have no pagination, unlike transactions

  backendbugdatabaseGrantFox OSSMaybe RewardedOfficial Campaign | FWC26very hard
  StellarSend/backend#27 · Filter by author abayomicornelius opened on Jul 15, 2026
  2