Issues

• [Performance]: Unbounded in-memory investment aggregation in PortfolioService loads entire user history on every page

  bugdomain: backendpriority: p1Stellar Wave
  StellarState/SS-backend#634 · Filter by author TS-mfon opened on Oct 17, 2026
  9

  

• [Database]: Migration 1731900000001 fails because is_kyc_verified column already exists in InitialSchema

  bugdomain: databasepriority: p1Stellar Wave
  StellarState/SS-backend#631 · Filter by author TS-mfon opened on Oct 17, 2026
  5

  

• [Database]: TypeORM migration timestamp collisions and inverted execution order cause migration failure on fresh DB

  bugdomain: databasepriority: p0Stellar Wave
  StellarState/SS-backend#630 · Filter by author TS-mfon opened on Oct 17, 2026
  6

  

• [Reliability]: Missing SIGTERM/SIGINT signal handling causes abrupt process termination without graceful shutdown

  bugdomain: backendpriority: p1Stellar Wave
  StellarState/SS-backend#629 · Filter by author TS-mfon opened on Oct 17, 2026
  6

  

• [Reliability]: Concurrent settlement workers (InvoiceMaturityWorker & SettlementWorker) race to settle identical invoices

  bugdomain: backendpriority: p1Stellar Wave
  StellarState/SS-backend#627 · Filter by author TS-mfon opened on Oct 17, 2026
  5

  

• [Bug]: KYC document submission endpoints incorrectly require seller role, blocking investors from KYC

  bugdomain: backendpriority: p1Stellar Wave
  StellarState/SS-backend#626 · Filter by author TS-mfon opened on Oct 17, 2026
  6

  

• [Bug]: Non-functional stub in /invoices/publish returns success without publishing the invoice

  bugdomain: backendpriority: p1Stellar Wave
  StellarState/SS-backend#625 · Filter by author TS-mfon opened on Oct 17, 2026
  4

  

• [Bug]: Secondary market createListing lacks holding reservation allowing over-listing and double-selling

  bugdomain: backendpriority: p1Stellar Wave
  StellarState/SS-backend#621 · Filter by author TS-mfon opened on Oct 17, 2026
  3

  

• [Bug]: Secondary market buyListing uses simulated placeholder transaction and fails to transfer fraction ownership

  bugdomain: backendpriority: p0Stellar Wave
  StellarState/SS-backend#620 · Filter by author TS-mfon opened on Oct 17, 2026
  3

  

• [Reliability]: Soroban transaction confirmation timeout leaves blockchain and database state desynchronized

  bugdomain: backendpriority: p2Stellar Wave
  StellarState/SS-backend#619 · Filter by author TS-mfon opened on Oct 17, 2026
  4

  

• [Bug]: Soroban event indexer settlement ingestion fails to record investor returns and status history

  bugdomain: backendpriority: p1Stellar Wave
  StellarState/SS-backend#618 · Filter by author TS-mfon opened on Oct 17, 2026
  4

  

• [Reliability]: Blockchain RPC called inside TypeORM database transaction in settlement.service.ts risks double-spend on rollback

  bugdomain: backendpriority: p0Stellar Wave
  StellarState/SS-backend#616 · Filter by author TS-mfon opened on Oct 17, 2026
  3

  

• [Maintenance]: Deprecated stellar-sdk dependency and lack of migration to @stellar/stellar-sdk

  domain: backendenhancementpriority: p2Stellar Wave
  StellarState/SS-backend#615 · Filter by author TS-mfon opened on Oct 17, 2026
  4

  

• [Bug]: Horizon health probe reads undefined HORIZON_URL instead of STELLAR_HORIZON_URL in app.ts

  bugdomain: backendpriority: p2Stellar Wave
  StellarState/SS-backend#614 · Filter by author TS-mfon opened on Oct 17, 2026
  4

  

• [Security]: Payment verification replay vulnerability allows reusing same Stellar transaction across multiple investments

  bugdomain: backenddomain: securitypriority: p0Stellar Wave
  StellarState/SS-backend#613 · Filter by author TS-mfon opened on Oct 17, 2026
  3

  

• [Security]: Unrestricted SSRF vulnerability in WebhookDispatcherService allows internal network access

  bugdomain: backenddomain: securitypriority: p0Stellar Wave
  StellarState/SS-backend#612 · Filter by author TS-mfon opened on Oct 17, 2026
  2

• [Bug]: Strict Bearer scheme casing in admin-auth.middleware.ts rejects valid lowercase bearer headers

  bugdomain: backendpriority: p2Stellar Wave
  StellarState/SS-backend#611 · Filter by author TS-mfon opened on Oct 17, 2026
  3

  

• [Security]: authenticateJWT creates synthetic user objects and bypasses user suspension checks

  bugdomain: backenddomain: securitypriority: p1Stellar Wave
  StellarState/SS-backend#610 · Filter by author TS-mfon opened on Oct 17, 2026
  3

  

• [Security]: Permissive CORS default reflects arbitrary origins with credentials enabled in app.ts

  bugdomain: backenddomain: securitypriority: p1Stellar Wave
  StellarState/SS-backend#609 · Filter by author TS-mfon opened on Oct 17, 2026
  1

• [Bug]: Admin KYC and invoice review handlers reject valid admin JWT authentication due to hardcoded x-admin-key check

  bugdomain: backendpriority: p1Stellar Wave
  StellarState/SS-backend#608 · Filter by author TS-mfon opened on Oct 17, 2026
  6

  

• [Security]: Admin authentication uses timing-vulnerable string equality and weak default key in admin.routes.ts

  bugdomain: backenddomain: securitypriority: p0Stellar Wave
  StellarState/SS-backend#607 · Filter by author TS-mfon opened on Oct 17, 2026
  6

  

• [Security]: IP whitelist bypass via unvalidated X-Forwarded-For header in ip-whitelist.middleware.ts

  bugdomain: backenddomain: securitypriority: p0Stellar Wave
  StellarState/SS-backend#606 · Filter by author TS-mfon opened on Oct 17, 2026
  2

• [Bug]: JWT algorithm confusion vulnerability allows asymmetric key substitution in auth.middleware.ts

  bugdomain: backenddomain: securitypriority: p0Stellar Wave
  StellarState/SS-backend#605 · Filter by author TS-mfon opened on Oct 17, 2026
  1

• Add platform-wide search API across invoices, issuers, and transactions

  Stellar Wave
  StellarState/SS-backend#602 · Filter by author TS-mfon opened on Oct 16, 2026
  1

• Implement session management API with active sessions list and revocation

  Stellar Wave
  StellarState/SS-backend#601 · Filter by author TS-mfon opened on Oct 16, 2026
  1