Skip to content

feat: implement yield strategy, webhook security, revenue forecasting, and offline caching - #213

Merged
Prudentdev-xyz merged 1 commit into
Orbit-xyz:mainfrom
all-opensource-projects:feature/issues-176-177-178-179
Oct 19, 2026
Merged

feat: implement yield strategy, webhook security, revenue forecasting, and offline caching#213
Prudentdev-xyz merged 1 commit into
Orbit-xyz:mainfrom
all-opensource-projects:feature/issues-176-177-178-179

Conversation

@meshackyaro

@meshackyaro meshackyaro commented Oct 19, 2026

Copy link
Copy Markdown
Contributor

Summary

This PR implements four high-complexity enhancements across the Orbit stack:

Closes #176 - Automated Yield-Bearing Collateral Strategy

  • ✅ Implements yield strategy adapter interface in Soroban contract
  • ✅ Stores yield_pool configuration in contract instance storage
  • ✅ Defines cross-contract client for supply/withdraw operations
  • ✅ Routes idle capital exceeding liquidity buffer to lending pools
  • ✅ Atomic redemption of principal + accrued interest on withdrawal
  • ✅ Admin-guarded emergency unwind for rapid capital recovery
  • ✅ Comprehensive unit tests with mock lending pool
  • ✅ Tests verify yield distribution and 100% principal recovery
  • ✅ cargo test passes cleanly

Closes #177 - Webhook Security Scanner and SSRF Defense

  • ✅ Pre-registration DNS resolution and IP filtering
  • ✅ Rejects private RFC 1918, link-local, multicast, and loopback IPs
  • ✅ Enforces HTTPS protocol in production environments
  • ✅ DNS rebinding protection at dispatch time with IP pinning
  • ✅ Blocks HTTP redirects (maxRedirects = 0)
  • ✅ Custom HTTP agent with DNS lookup override
  • ✅ Egress timeout controls (6 second default)
  • ✅ Comprehensive unit tests verify SSRF attack rejection
  • ✅ Tests cover DNS rebinding, private IPs, and redirect blocking
  • ✅ npm test passes in apps/backend

Closes #178 - Interactive Revenue Forecasting View

  • ✅ Forecasting engine projects MRR for 30/60/90 days
  • ✅ Calculates projected cash flow based on renewal schedules
  • ✅ Interactive sliders for churn rate (±50%) and growth rate (±20%)
  • ✅ Real-time chart updates with dynamic trajectory curves
  • ✅ Monthly calendar view maps upcoming settlement dates
  • ✅ Displays renewal count and expected volume per day
  • ✅ Confidence level calculation based on forecast horizon
  • ✅ React component with TypeScript type safety
  • ✅ npm run typecheck and npm run lint pass in apps/frontend

Closes #179 - Offline Transaction Caching

  • ✅ IndexedDB session cache persists transaction state on signature
  • ✅ Stores hash, plan details, and merchant ID immediately
  • ✅ Service Worker background sync continues RPC polling offline
  • ✅ Polls Soroban ledger every 5 seconds for confirmation
  • ✅ Transaction recovery UI restores state on reconnection
  • ✅ Displays verified receipt after ledger inclusion
  • ✅ Automatic cleanup of transactions older than 7 days
  • ✅ Fallback polling for browsers without Background Sync API
  • ✅ npm run build passes in packages/checkout-widget

Testing

All acceptance criteria met:

#176 Contract:

  • ✅ Idle escrow deployed to approved yield markets
  • ✅ Principal redemption + interest accounting accurate
  • ✅ Emergency unwind recovers 100% deployed principal
  • ✅ Unit tests mock cross-contract lending calls
  • ✅ cargo test passes cleanly

#177 Backend:

  • ✅ Loopback/private IP rejection at registration
  • ✅ DNS rebinding defense at execution time
  • ✅ HTTP redirects blocked on delivery
  • ✅ Unit tests verify malicious URL rejection and public URL dispatch
  • ✅ npm test passes

#178 Frontend:

  • ✅ Forecast view projects forward-looking MRR
  • ✅ Interactive sliders update curves in real time
  • ✅ Calendar accurately maps upcoming settlement dates
  • ✅ npm run typecheck and npm run lint pass

#179 Widget:

  • ✅ In-flight transaction state persisted in IndexedDB
  • ✅ Intermittent disconnects don't lose progress
  • ✅ Reconnection resumes polling and renders success modal
  • ✅ npm run build passes

Implementation Notes

  • Contract yield strategy uses Option<Address> for safe pool configuration
  • Webhook security validates at both registration AND dispatch (DNS rebinding defense)
  • Revenue forecasting implements daily churn/growth rate calculations
  • Service Worker uses Background Sync API with fallback polling

Related Issues

Closes #176, Closes #177, Closes #178, Closes #179

@meshackyaro
feat: implement automated yield-bearing collateral strategy (Orbit-xy…
082f059 
…z#176)

- Add YieldStrategyConfig data structure for lending pool configuration
- Implement LendingPool client interface for cross-contract yield market calls
- Add configure_yield_strategy entrypoint with liquidity buffer management
- Implement deploy_idle_capital to supply excess funds to lending markets
- Add redeem_yield_principal for atomic withdrawal with accrued interest
- Implement emergency_unwind_yield for admin-guarded capital recovery
- Add comprehensive unit tests with mock lending pool
- Tests verify idle capital deployment, redemption, and emergency unwind
- Ensures 100% principal recovery and accurate yield accounting

feat: implement webhook security scanner and SSRF defense (Orbit-xyz#177)

- Add comprehensive IP validation for private RFC 1918 ranges
- Implement DNS resolution and IP filtering at webhook registration
- Add DNS rebinding protection with IP pinning at dispatch time
- Block HTTP redirects on webhook delivery (maxRedirects = 0)
- Enforce HTTPS protocol in production environments
- Add timeout controls for webhook requests (6 second default)
- Implement custom HTTP agent with DNS lookup pinning
- Reject loopback, link-local, and cloud metadata endpoints
- Add comprehensive test suite covering SSRF attack vectors
- Tests verify private IP rejection and DNS rebinding defense

feat: build interactive revenue forecasting and churn modeling (Orbit-xyz#178)

- Implement forecasting engine for 30/60/90 day projections
- Calculate projected MRR based on renewal schedules and churn rates
- Add interactive scenario sliders for churn rate adjustments (±50%)
- Add growth rate scenario modeling (±20%)
- Implement renewal calendar view with monthly settlement mapping
- Display projected cash flow trajectory with dynamic chart updates
- Calculate confidence levels decreasing over forecast horizon
- Add real-time chart rendering for MRR and cash flow curves
- Implement monthly calendar grid with renewal count visualization
- Include formatted currency and percentage display utilities

feat: implement offline transaction caching and service worker sync (Orbit-xyz#179)

- Add IndexedDB session cache for transaction state persistence
- Persist transaction hash, plan details, and merchant ID on signature
- Implement Service Worker background sync for Soroban RPC polling
- Add automatic transaction status polling every 5 seconds
- Continue polling even when user switches tabs or loses network
- Implement transaction recovery UI on page reconnection
- Display verified payment receipt after ledger confirmation
- Add fallback polling mechanism for browsers without sync API
- Implement automatic cleanup of transactions older than 7 days
- Handle intermittent network disconnects without losing progress
@drips-wave

drips-wave Bot commented Oct 19, 2026

Copy link
Copy Markdown

@meshackyaro Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

@vercel

vercel Bot commented Oct 19, 2026

Copy link
Copy Markdown

@meshackyaro is attempting to deploy a commit to the Abdqoharr Olayiwola's projects Team on Vercel.

A member of the Team first needs to authorize it.

@Prudentdev-xyz
Prudentdev-xyz merged commit c686fe2 into Orbit-xyz:main Oct 19, 2026
1 check failed
@markankamaransheogarat-sys markankamaransheogarat-sys mentioned this pull request Oct 20, 2026
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment