Issues

• [frontend] - Card component does not support an as prop for semantic HTML rendering every card as a div

  accessibilityfrontendStellar Wave
  arflexx/Airflex#358 · Filter by author dark-sarge opened on Sep 24, 2026
  3

• [frontend] - app/not-found.tsx page does not include search or link suggestions offering no path forward to lost users

  frontendStellar Waveux
  arflexx/Airflex#356 · Filter by author dark-sarge opened on Sep 24, 2026
  3

• [frontend] - Sell page form fields lose their values on navigating away and back forcing the seller to re-enter everything

  frontendStellar Waveux
  arflexx/Airflex#355 · Filter by author dark-sarge opened on Sep 24, 2026
  4

• [contract] - Both contracts lack a version() view function making deployed versions indistinguishable

  contractenhancementStellar Wave
  arflexx/Airflex#296 · Filter by author dark-sarge opened on Sep 24, 2026
  1

• [frontend] - AuthGuard redirects using window.location.href bypassing Next.js router and causing full page reload

  bugfrontend
  arflexx/Airflex#267 · Filter by author dark-sarge opened on Sep 24, 2026

• [frontend] - Wallet page shows XLM balance prefixed with Naira symbol instead of XLM

  bugfrontend
  arflexx/Airflex#266 · Filter by author dark-sarge opened on Sep 24, 2026

• [frontend] - useTrade hook has missing dependency in useEffect causing stale closure bugs

  bugfrontend
  arflexx/Airflex#265 · Filter by author dark-sarge opened on Sep 24, 2026

• [frontend] - Trade detail page has no loading skeleton showing blank screen during data fetch

  frontendux
  arflexx/Airflex#264 · Filter by author dark-sarge opened on Sep 24, 2026

• [backend] - Referral code generation has insufficient entropy for uniqueness at scale

  backendsecurity
  arflexx/Airflex#263 · Filter by author dark-sarge opened on Sep 24, 2026

• [backend] - POST /api/v1/trades/:id/dispute does not call flag_dispute on escrow contract creating on-chain/off-chain state mismatch

  backendbug
  arflexx/Airflex#262 · Filter by author dark-sarge opened on Sep 24, 2026

• [backend] - Hard-deletion background job for accounts past the 30-day grace window does not exist

  backendbugcompliance
  arflexx/Airflex#261 · Filter by author dark-sarge opened on Sep 24, 2026

• [backend] - GET /api/v1/trades does not return seller rating in typed fields causing TradeOffer type mismatch

  backendbug
  arflexx/Airflex#260 · Filter by author dark-sarge opened on Sep 24, 2026

• [backend] - POST /api/v1/kyc/submit stores NIN in plaintext in the database

  backendsecurity
  arflexx/Airflex#259 · Filter by author dark-sarge opened on Sep 24, 2026

• [backend] - Recovery codes stored as SHA-256 hashes which are brute-forceable for short alphanumeric codes

  backendsecurity
  arflexx/Airflex#258 · Filter by author dark-sarge opened on Sep 24, 2026

• [backend] - SSE events endpoint has no heartbeat causing clients to timeout behind proxies

  backendbug
  arflexx/Airflex#257 · Filter by author dark-sarge opened on Sep 24, 2026

• [backend] - GET /api/v1/admin/users computes balance via correlated subquery — O(n) per user

  backendperformance
  arflexx/Airflex#256 · Filter by author dark-sarge opened on Sep 24, 2026

• [backend] - Paystack webhook handler does not verify X-Paystack-Signature header

  backendsecurity
  arflexx/Airflex#255 · Filter by author dark-sarge opened on Sep 24, 2026

• [backend] - tradeVerification has no dead-letter queue or alerting when all retry attempts fail

  backendbug
  arflexx/Airflex#254 · Filter by author dark-sarge opened on Sep 24, 2026

• [backend] - Missing composite index on trade_offers(status, expires_at) causes full table scans on homepage query

  backendperformance
  arflexx/Airflex#253 · Filter by author dark-sarge opened on Sep 24, 2026

• [backend] - POST /api/v1/auth/recover/change-phone issues session JWT without verifying new phone ownership via OTP

  backendsecurity
  arflexx/Airflex#252 · Filter by author dark-sarge opened on Sep 24, 2026

• [backend] - fraudDetection.checkVelocity uses in-memory cache which resets on restart, defeating rate-limiting across replicas

  backendsecurity
  arflexx/Airflex#251 · Filter by author dark-sarge opened on Sep 24, 2026

• [backend] - No idempotency key support on POST /api/v1/trades — duplicate submissions create duplicate on-chain listings

  backendbug
  arflexx/Airflex#250 · Filter by author dark-sarge opened on Sep 24, 2026

• [backend] - GET /api/v1/admin/users/:phone exposes full phone number without masking

  backendsecurity
  arflexx/Airflex#249 · Filter by author dark-sarge opened on Sep 24, 2026

• [backend] - KYC documents stored on local filesystem — breaks horizontal scaling and lost on container restart

  backendbuginfrastructure
  arflexx/Airflex#248 · Filter by author dark-sarge opened on Sep 24, 2026

• [backend] - JWT_SECRET falls back to undefined with non-null assertion instead of failing fast at startup

  backendbug
  arflexx/Airflex#247 · Filter by author dark-sarge opened on Sep 24, 2026