-
Notifications
You must be signed in to change notification settings - Fork 28
All issues
Issue creation is restricted in this repository
Issues
is:issue state:open
is:issue state:open
Search results
hard: role-gated endpoints trust stale JWT role claims — blocked/downgraded users keep permissions until token expiry
bugSomething isn't workingSomething isn't workingGrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardIssue may be eligible for a GrantFox rewardThird CampaignCampaign: Third CampaignCampaign: Third CampaignStatus: Open.#122 In StepFi-app/StepFi-API;hard: ApiKeyGuard hammers Supabase per request, leaks timing behavior, and has no per-key abuse controls
bugSomething isn't workingSomething isn't workingGrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardIssue may be eligible for a GrantFox rewardThird CampaignCampaign: Third CampaignCampaign: Third CampaignStatus: Open.#121 In StepFi-app/StepFi-API;hard: registration wallet-existence checks are TOCTOU — concurrent registers create duplicate identities
bugSomething isn't workingSomething isn't workingGrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardIssue may be eligible for a GrantFox rewardThird CampaignCampaign: Third CampaignCampaign: Third CampaignStatus: Open.#120 In StepFi-app/StepFi-API;hard: refresh-token rotation lacks reuse detection and blocked users keep live sessions
bugSomething isn't workingSomething isn't workingGrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardIssue may be eligible for a GrantFox rewardThird CampaignCampaign: Third CampaignCampaign: Third CampaignStatus: Open.#119 In StepFi-app/StepFi-API;critical: signature challenge is not domain-bound — raw-nonce and SEP-0043 fallback accept cross-service signature replay
bugSomething isn't workingSomething isn't workingGrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardIssue may be eligible for a GrantFox rewardThird CampaignCampaign: Third CampaignCampaign: Third CampaignStatus: Open.#118 In StepFi-app/StepFi-API;critical: POST /transactions submits arbitrary third-party XDR with no source-account binding, idempotency, or rate limits
bugSomething isn't workingSomething isn't workingGrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardIssue may be eligible for a GrantFox rewardThird CampaignCampaign: Third CampaignCampaign: Third CampaignStatus: Open.#117 In StepFi-app/StepFi-API;critical: SIWE-style nonce verification has a TOCTOU race — one nonce can authenticate multiple sessions
bugSomething isn't workingSomething isn't workingGrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardIssue may be eligible for a GrantFox rewardThird CampaignCampaign: Third CampaignCampaign: Third CampaignStatus: Open.#116 In StepFi-app/StepFi-API;critical: admin audit-log endpoints have no role gate — any authenticated wallet can read full audit trail
bugSomething isn't workingSomething isn't workingGrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardIssue may be eligible for a GrantFox rewardThird CampaignCampaign: Third CampaignCampaign: Third CampaignStatus: Open.#115 In StepFi-app/StepFi-API;