Issues

• No test confirms SearchQueryBuilder (search/backend/searchAPI.js) is resilient to maliciously large or deeply-nested filter payloads

  Stellar Wave
  Trust-Analysis/Tokenized-Fractional-#979 · Filter by author Fatimasanusi opened on Oct 19, 2026
  7

  

• Two parallel API-key authentication mechanisms (a Postgres-backed api_keys table and a single shared ADMIN_API_KEY env var) may coexist with no documented reconciliation

  Stellar Wave
  Trust-Analysis/Tokenized-Fractional-#978 · Filter by author Fatimasanusi opened on Oct 19, 2026
  6

  

• No test confirms the read-replica configuration falls back to the primary when all configured replicas are unreachable

  Stellar Wave
  Trust-Analysis/Tokenized-Fractional-#977 · Filter by author Fatimasanusi opened on Oct 19, 2026
  6

  

• No documented read-after-write consistency handling for the Postgres read-replica configuration

  Stellar Wave
  Trust-Analysis/Tokenized-Fractional-#976 · Filter by author Fatimasanusi opened on Oct 19, 2026
  6

  

• getAssetCdnUrl()'s normalizeBaseUrl() silently returns an empty string for a malformed CDN URL env var instead of failing startup

  Trust-Analysis/Tokenized-Fractional-#956 · Filter by author Fatimasanusi opened on Oct 19, 2026

• cdn.js's isExternalUrl() has no allowlist of trusted CDN domains — any syntactically valid absolute URL is accepted

  Trust-Analysis/Tokenized-Fractional-#955 · Filter by author Fatimasanusi opened on Oct 19, 2026

• backend/reconciliation.js's 'Database vs Blockchain' repair strategy is only 'flag for manual review,' with no confirmed alerting

  Trust-Analysis/Tokenized-Fractional-#954 · Filter by author Fatimasanusi opened on Oct 19, 2026

• No documented migration path exists for moving data.json content into the Postgres assets table that already has a matching schema

  Trust-Analysis/Tokenized-Fractional-#953 · Filter by author Fatimasanusi opened on Oct 19, 2026

• dataService.js's loadData() silently resets to an empty dataset on any JSON parse failure, discarding all asset data with only a log line

  Trust-Analysis/Tokenized-Fractional-#952 · Filter by author Fatimasanusi opened on Oct 19, 2026

• backend/consistency.js's three-way reconciliation treats data.json as the 'persistent source of truth,' per its own doc comment, rather than the Postgres database

  Trust-Analysis/Tokenized-Fractional-#951 · Filter by author Fatimasanusi opened on Oct 19, 2026

• k8s/backend-deployment.yaml defines no volume or PersistentVolumeClaim, so data.json is lost on every pod restart and diverges across the 2 replicas

  Trust-Analysis/Tokenized-Fractional-#950 · Filter by author Fatimasanusi opened on Oct 19, 2026

• The live, mounted /api/v1/rwa routes still read and write a flat data.json file, despite a full Postgres schema already existing

  Trust-Analysis/Tokenized-Fractional-#949 · Filter by author Fatimasanusi opened on Oct 19, 2026

• No test suite comparable to the main contract's exists for contracts/multi_asset or contracts/vault

  Trust-Analysis/Tokenized-Fractional-#948 · Filter by author Fatimasanusi opened on Oct 19, 2026

• contracts/multi_asset/src/lib.rs's inconsistent formatting (a blank line after nearly every statement) suggests rustfmt is not enforced for this file

  Trust-Analysis/Tokenized-Fractional-#947 · Filter by author Fatimasanusi opened on Oct 19, 2026

• contracts/vault/src/state.rs uses Windows-style CRLF line endings, inconsistent with the rest of the Rust codebase

  Trust-Analysis/Tokenized-Fractional-#946 · Filter by author Fatimasanusi opened on Oct 19, 2026

• No shared, reusable module exists for the holder-registry pattern, which is why the same unbounded-Vec bug was implemented three times

  Trust-Analysis/Tokenized-Fractional-#945 · Filter by author Fatimasanusi opened on Oct 19, 2026

• multi_asset contract has no equivalent of the main contract's admin timelock for any of its privileged functions

  Trust-Analysis/Tokenized-Fractional-#944 · Filter by author Fatimasanusi opened on Oct 19, 2026

• Add FAQ / troubleshooting guide

  documentationgood first issueStellar Wave
  Trust-Analysis/Tokenized-Fractional-#120 · Filter by author Fatimasanusi opened on Jun 26, 2026
  4

  

• Add LICENSE file

  documentationgood first issueStellar Wave
  Trust-Analysis/Tokenized-Fractional-#117 · Filter by author Fatimasanusi opened on Jun 26, 2026
  3

  

• Add .nvmrc and .node-version files

  good first issueStellar Wave
  Trust-Analysis/Tokenized-Fractional-#110 · Filter by author Fatimasanusi opened on Jun 26, 2026
  4