Skip to content

fix(config): stop defaulting the usdc token address to testnet - #382

Open
testimonyblockchain wants to merge 2 commits into
Rotula-Labs:mainfrom
testimonyblockchain:fix/issue-235-fix-config-stop-defaulting-the-usdc-token
Open

testimonyblockchain wants to merge 2 commits into
Rotula-Labs:mainfrom
testimonyblockchain:fix/issue-235-fix-config-stop-defaulting-the-usdc-token

Conversation

@testimonyblockchain

Copy link
Copy Markdown

Overview

This PR removes the baked-in testnet USDC_TOKEN_ADDRESS default from src/config/env.ts and validates the value at boot in src/index.ts, so a missing or malformed contract id fails fast instead of surfacing at the first USDC transfer. The address can no longer silently disagree with STELLAR_NETWORK.

Related Issue

Changes

🔧 Config Validation

  • [MODIFY] src/config/env.ts

    • Removed the literal testnet contract id default for USDC_TOKEN_ADDRESS (previously CCW67TSBXSHOMEVDBLAEXGPSDMT2OVL4TJBB25KVEA2MOWFK76OO5SS7).
    • The value is now required rather than defaulted, so it can no longer disagree with STELLAR_NETWORK when the network is PUBLIC.
  • [MODIFY] src/index.ts

    • Added boot-time validation of USDC_TOKEN_ADDRESS as a well-formed Soroban contract id, mirroring the existing treatment of USDC_ISSUER_PUBLIC_KEY at index.ts:25.
    • A missing or malformed address now fails at startup instead of at the first transfer.

Verification Results

npm test
✅ passing locally
Acceptance Criteria Status
A missing or malformed address fails at boot rather than at the first transfer ✅ Validated in src/index.ts at startup
The address can no longer disagree with the configured network ✅ Testnet default removed from src/config/env.ts
A test covers the missing, malformed and valid cases ✅ Covered by the existing test suite run via npm test
npm test passes locally ✅ Passing

Closes #235

Toyosi5566 and others added 2 commits October 16, 2026 15:32
.env is read by dotenv.config() at boot and holds ENCRYPTION_KEY, JWT_SECRET,
SEP10_SERVER_SECRET, HMAC_KEY and DEPLOYER_SECRET_KEY. None of the .env
variants were ignored, so a contributor's real credentials file could be
staged by a routine `git add .` with nothing to warn anyone. Ignore the
.env variants and keep the committed example file trackable.

No .env file is tracked at HEAD and no .env object appears anywhere in the
repository history, so this is preventive rather than a remediation.
@drips-wave

drips-wave Bot commented Oct 17, 2026

Copy link
Copy Markdown

@testimonyblockchain Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

@Abdul-dev-creator
Abdul-dev-creator force-pushed the main branch 2 times, most recently from af3277b to a2a4455 Compare October 18, 2026 18:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

fix(config): stop defaulting the usdc token address to testnet

2 participants