Issues

• The access_token cookie is set without the secure flag outside NODE_ENV=production, including on HTTPS staging deploys

  good first issuesecurity
  MergeFi/backend#614 · Filter by author chonilius opened on Oct 13, 2026
  1

• POST /milestones/:id/allocate and /bounties/:id/approve|reject are documented in Swagger as working operations

  documentationgood first issue
  MergeFi/backend#613 · Filter by author chonilius opened on Oct 13, 2026
  1

• test/users.e2e-spec.ts expects 403 for an unauthenticated request, but JwtAuthGuard returns 401

  good first issuetesting
  MergeFi/backend#612 · Filter by author chonilius opened on Oct 13, 2026
  1

• STELLAR_NETWORK and STELLAR_NETWORK_PASSPHRASE are never cross-checked

  bugsecurity
  MergeFi/backend#611 · Filter by author chonilius opened on Oct 13, 2026

• ESCROW_DEADLINE_SECONDS and PORT are parsed without validation — a typo makes every fund throw RangeError

  buggood first issue
  MergeFi/backend#610 · Filter by author chonilius opened on Oct 13, 2026

• deriveOnChainId hashes UUIDs into u64 keys with no collision check, and milestone/pool keys share the escrow contract's issue_id space

  bugsecurity
  MergeFi/backend#609 · Filter by author chonilius opened on Oct 13, 2026

• MaintenancePoolService.assignReward reports a stale balance in its 'exceeds pool balance' error

  buggood first issue
  MergeFi/backend#608 · Filter by author chonilius opened on Oct 13, 2026

• Controller specs pass unbound methods to expect() (unbound-method lint errors)

  good first issueStellar Wavetesting
  MergeFi/backend#606 · Filter by author chonilius opened on Oct 13, 2026
  3

  

• Unused variables on main hide logic that was lost in merges (previousStatus, existingPool, callerUserId…)

  buggood first issue
  MergeFi/backend#605 · Filter by author chonilius opened on Oct 13, 2026

• common/validators/date.validator.ts has no spec file

  good first issueStellar Wavetesting
  MergeFi/backend#604 · Filter by author chonilius opened on Oct 13, 2026
  2

  

• BountiesService.expireOverdue() overwrites concurrently-advanced bounties to EXPIRED — read-then-save with no status re-check and no assertTransition

  architecturebugStellar Wavevery hard
  MergeFi/backend#460 · Filter by author chonilius opened on Sep 27, 2026
  3

  

• assignReward decrements MaintenancePool.balance before poolWithdraw() and never restores it when the withdrawal fails

  architecturebugStellar Wavevery hard
  MergeFi/backend#459 · Filter by author chonilius opened on Sep 27, 2026
  5

  

• [Regression on closed #273] assignReward's double-payout guard is keyed on (pool, recipient) instead of (pool, issue) — the same issue can still be paid twice

  bugsecurityStellar Wavevery hard
  MergeFi/backend#458 · Filter by author chonilius opened on Sep 27, 2026
  4

  

• MaintenancePoolService.deposit() always throws PessimisticLockTransactionRequiredError — the #275 SELECT ... FOR UPDATE runs outside any transaction

  architecturebugStellar Wavevery hard
  MergeFi/backend#457 · Filter by author chonilius opened on Sep 27, 2026
  5

  

• releasePartial() sends the wrong on-chain key to the contract — a raw UUID instead of the numeric onChainId every other operation uses

  MergeFi/backend#300 · Filter by author circleboyslimited opened on Sep 17, 2026
  5

• EscrowService.refund()/release() check the caller's role but never bind the check to the specific escrow's sponsor — any SPONSOR can force-refund any other sponsor's escrow

  MergeFi/backend#299 · Filter by author abayomiwav opened on Sep 17, 2026
  2

• Bounty/Milestone/MaintenancePool/User list endpoints have no pagination and return the entire table in one unbounded response

  GrantFox OSSMaybe RewardedOfficial Campaign | FWC26performanceThird Campaignvery hard
  MergeFi/backend#63 · Filter by author chonilius opened on Aug 16, 2026
  3

  

• TeamMemberSplit.user uses onDelete: CASCADE, so deleting any team member's account silently desyncs a team's split percentages from 100 and can permanently strand that team's bounty

  architecturebugGrantFox OSSMaybe RewardedOfficial Campaign | FWC26Third Campaignvery hard
  MergeFi/backend#58 · Filter by author chonilius opened on Aug 16, 2026
  2

  

• Because no money-moving route requires auth, IdempotencyInterceptor buckets every caller under a shared 'anonymous' identity per scope, letting unrelated callers collide on each other's cached responses

  bugGrantFox OSSMaybe RewardedOfficial Campaign | FWC26securityThird Campaignvery hard
  MergeFi/backend#55 · Filter by author chonilius opened on Aug 16, 2026
  2

  

• release() and splitRelease() never check for pre-existing Payment rows, so calling them after releasePartial causes a double payout of the full escrow amount

  bugGrantFox OSSMaybe RewardedOfficial Campaign | FWC26securityThird Campaignvery hard
  MergeFi/backend#44 · Filter by author chonilius opened on Aug 16, 2026
  3

  

• Money-moving DTOs trust client-supplied contributorId/recipientId/funderAddress instead of binding to the authenticated caller

  architectureGrantFox OSSMaybe RewardedOfficial Campaign | FWC26securityThird Campaignvery hard
  MergeFi/backend#40 · Filter by author chonilius opened on Aug 16, 2026
  2

  

• UsersController.setStellarAddress is authenticated but not authorized: any logged-in user can overwrite another user's payout address

  bugGrantFox OSSMaybe RewardedOfficial Campaign | FWC26securityThird Campaignvery hard
  MergeFi/backend#39 · Filter by author chonilius opened on Aug 16, 2026
  2

  

• Docker/deployment tooling is entirely absent: no Dockerfile, no docker-compose for local Postgres, no CI pipeline definition

  documentationenhancementGrantFox OSShelp wantedMaybe RewardedOfficial Campaign | FWC26very hard
  MergeFi/backend#30 · Filter by author chonilius opened on Jul 15, 2026
  3