MergeFi

MergeFi/backend

0 stars 3 forks 0 watchers TypeScript
View on GitHub Website
83 Open Issues Need Help Last updated: Jul 15, 2026

Open Issues Need Help

View All on GitHub
Add comprehensive test coverage for the bounty state machine, escrow release math, and webhook-to-payout integration flow (currently near-zero coverage) 3 days ago
help wanted very hard testing Maybe Rewarded GrantFox OSS Official Campaign | FWC26 Stellar Wave
MergeFi/backend
0

TypeScript
eslint fully disables @typescript-eslint/no-explicit-any, a third rule beyond the two the existing eslint-downgrade issue names 3 days ago
bug enhancement help wanted very hard Stellar Wave
MergeFi/backend
0

TypeScript
package.json has no engines field pinning a Node.js version, despite CI hardcoding Node 24 3 days ago
bug enhancement help wanted very hard Stellar Wave
MergeFi/backend
0

TypeScript
Roadmap's "recurring MaintenancePool deposits" item remains unimplemented — deposit() is entirely manual despite the monthlyDeposit field implying an automatic cadence 3 days ago
documentation enhancement help wanted very hard Stellar Wave
MergeFi/backend
0

TypeScript
Structured tracing/observability is entirely absent: no correlation IDs across the webhook -> bounty -> escrow -> Soroban call chain 3 days ago
enhancement help wanted very hard architecture Maybe Rewarded GrantFox OSS Official Campaign | FWC26 Stellar Wave
MergeFi/backend
0

TypeScript
sponsors.service.spec.ts has no test for activeBounties(), activeMilestones(), or milestoneProgress() 3 days ago
enhancement good first issue help wanted testing Stellar Wave
MergeFi/backend
0

TypeScript
Global ValidationPipe uses forbidNonWhitelisted: false, silently stripping unexpected request body fields instead of rejecting them 3 days ago
bug enhancement good first issue help wanted Stellar Wave
MergeFi/backend
0

TypeScript
apportionBasisPoints doesn't validate that its own input sums to ~100 before force-normalizing the output — and has no test for that scenario 3 days ago
bug documentation good first issue performance testing Stellar Wave
MergeFi/backend
0

TypeScript
FundEscrowDto has no DTO-level cross-field validation for exactly-one-parent, relies entirely on service-layer assertExactlyOneParent 3 days ago
documentation enhancement help wanted very hard Stellar Wave
MergeFi/backend
0

TypeScript
CreateMilestoneDto doesn't validate that deadline is in the future, same gap as CreateBountyDto (#108) 3 days ago
bug enhancement good first issue help wanted Stellar Wave
MergeFi/backend
0

TypeScript
None of the e2e-spec.ts files actually require real GitHub OAuth credentials, making CI's GITHUB_CLIENT_ID/SECRET gate unnecessary 3 days ago
bug help wanted very hard testing Stellar Wave
MergeFi/backend
0

TypeScript
CI's "Scan for Hardcoded Secrets" step only pattern-matches 3 narrow secret formats and never scans git history 3 days ago
bug help wanted very hard security Stellar Wave
MergeFi/backend
0

TypeScript
team-split.util.ts's validateSplitPercentages and escrow.service.ts's assertValidSplits independently reimplement near-identical split-percentage validation 3 days ago
bug help wanted very hard architecture Stellar Wave
MergeFi/backend
0

TypeScript
EscrowService.release/splitRelease/releasePartial mark the escrow RELEASED before (or without a transaction around) creating the corresponding Payment row, so a Payment-insert failure leaves a permanently-mismarked ledger 3 days ago
bug help wanted spike architecture Stellar Wave
MergeFi/backend
0

TypeScript
ReputationService.computeAndSave and AnalyticsService.forContributor duplicate nearly identical contributor-stats computation logic 3 days ago
bug help wanted very hard architecture Stellar Wave
MergeFi/backend
0

TypeScript
MaintenancePoolService.assignReward's repeated-releasePartial model has no counterpart in the real maintenance-pool contract either 3 days ago
bug help wanted very hard architecture Stellar Wave
MergeFi/backend
0

TypeScript
CI's E2E test step has never run — GITHUB_CLIENT_ID/GITHUB_CLIENT_SECRET have never been configured as repository secrets 3 days ago
bug help wanted very hard testing Stellar Wave
MergeFi/backend
0

TypeScript
Several free-text DTO fields have no @MaxLength(), and their entity columns have no varchar length either 3 days ago
enhancement good first issue security performance Stellar Wave
MergeFi/backend
0

TypeScript
MilestonesService.resolveIssue's incremental-release model has no counterpart in the real mergefi-milestones contract 3 days ago
help wanted very hard security architecture Stellar Wave
MergeFi/backend
0

TypeScript
BountiesController.list only supports filtering by status, despite the API tracking difficulty, asset, and repository/language data 3 days ago
enhancement good first issue help wanted security Stellar Wave
MergeFi/backend
0

TypeScript
releasePartial()'s entire capability has no corresponding entrypoint on the real escrow contract 3 days ago
bug help wanted very hard architecture Stellar Wave
MergeFi/backend
0

TypeScript
EscrowService.release() and releasePartial() invoke the identical on-chain method name 'release' with incompatible argument shapes 3 days ago
bug help wanted very hard architecture Stellar Wave
MergeFi/backend
0

TypeScript
TeamsService.create issues one separate INSERT per team member split instead of a single batched insert 3 days ago
good first issue help wanted performance architecture Stellar Wave
MergeFi/backend
0

TypeScript
WebhookEvent has no index on eventType, status, or receivedAt 3 days ago
documentation help wanted spike performance Stellar Wave
MergeFi/backend
0

TypeScript
CI workflow only triggers on pull_request to main — a direct push bypasses the entire pipeline including the secret scan 3 days ago
bug help wanted very hard architecture Stellar Wave
MergeFi/backend
0

TypeScript
EscrowService never passes contractId to soroban.invoke() — maintenancePoolContractId is completely dead configuration 3 days ago
bug help wanted very hard architecture Stellar Wave
MergeFi/backend
0

TypeScript
GithubWebhooksService.handlePullRequest never reacts to a PR being opened — markInReview only ever fires synthetically at merge time 3 days ago
bug enhancement help wanted very hard Stellar Wave
MergeFi/backend
0

TypeScript
EscrowService.splitRelease() invokes a 'split_release' method that doesn't exist on the real deployed contract 3 days ago
bug help wanted very hard architecture Stellar Wave
MergeFi/backend
0

TypeScript
AnalyticsController.forContributor has no authentication guard 3 days ago
bug help wanted very hard security Stellar Wave
MergeFi/backend
0

TypeScript
escrow.controller.spec.ts (the only controller spec in the codebase) exclusively tests metadata-stripping, not routing or idempotency wiring 3 days ago
help wanted very hard security testing Stellar Wave
MergeFi/backend
0

TypeScript
Issue.isMaintenanceType is computed and persisted on every GitHub sync but never read anywhere in the application 3 days ago
bug help wanted very hard architecture Stellar Wave
MergeFi/backend
0

TypeScript
Issue.state is typed 'open' | 'closed' in TypeScript but stored as an unconstrained varchar with no DB-level enum or CHECK 3 days ago
bug help wanted very hard architecture Stellar Wave
MergeFi/backend
0

TypeScript
Bounty.claimedById has no database index despite being the primary filter column for reputation and analytics 3 days ago
bug help wanted very hard performance Stellar Wave
MergeFi/backend
0

TypeScript
ReputationController has zero authentication guards, including POST /:userId/recompute 4 days ago
help wanted very hard security performance Stellar Wave
MergeFi/backend
0

TypeScript
JwtStrategy.validate trusts the JWT payload's sub/username with no database lookup at all 4 days ago
bug help wanted very hard security Stellar Wave
MergeFi/backend
0

TypeScript
syncIssues has no page/issue cap and runs synchronously inside the POST /github/sync/:owner/:repo request 4 days ago
help wanted very hard performance architecture Stellar Wave
MergeFi/backend
0

TypeScript
GithubAccount.accessToken and refreshToken are stored in plaintext despite the code's own TODO acknowledging they need encryption at rest 4 days ago
help wanted very hard security architecture Stellar Wave
MergeFi/backend
0

TypeScript
SponsorsController has zero authentication guards, exposing a sponsor's full financial dashboard to any unauthenticated caller 4 days ago
bug help wanted very hard security Stellar Wave
MergeFi/backend
0

TypeScript
AuthController.githubCallback puts the freshly issued JWT directly in the redirect URL's query string 4 days ago
help wanted very hard security architecture Stellar Wave
MergeFi/backend
0

TypeScript
upsertFromGithub's account-exists branch never refreshes User.username/displayName/email/avatarUrl on repeat login 4 days ago
bug enhancement help wanted very hard Stellar Wave
MergeFi/backend
0

TypeScript
UsersService.upsertFromGithub matches an existing User purely by username, enabling account takeover via GitHub username reuse 4 days ago
bug help wanted very hard security Stellar Wave
MergeFi/backend
0

TypeScript
users.e2e-spec.ts's two "should reject unauthenticated requests with 401" tests both actually assert .expect(403) 4 days ago
bug good first issue security testing Stellar Wave
MergeFi/backend
0

TypeScript
extractLinkedIssueNumbers discards the owner/repo qualifier in cross-repo closing keywords, causing false-positive linkage 4 days ago
bug enhancement help wanted very hard Stellar Wave
MergeFi/backend
0

TypeScript
SetStellarAddressDto.stellarAddress is validated only with @IsString(), unlike every other Stellar-address-accepting DTO in the codebase 4 days ago
bug help wanted very hard security Stellar Wave
MergeFi/backend
0

TypeScript
GithubWebhooksService.handleEvent marks unrecognized webhook event types as PROCESSED even though nothing was done 4 days ago
bug help wanted spike architecture Stellar Wave
MergeFi/backend
0

TypeScript
GithubStrategy requests the read:org OAuth scope but nothing in the codebase reads org membership data 4 days ago
good first issue help wanted security architecture Stellar Wave
MergeFi/backend
0

TypeScript
GithubSyncService.logRateLimitStatus consumes the rate-limit budget it's meant to conserve 4 days ago
help wanted very hard security performance Stellar Wave
MergeFi/backend
0

TypeScript
handlePullRequest only handles merged PRs — a PR closed without merging has no handler at all 4 days ago
bug help wanted very hard testing Stellar Wave
MergeFi/backend
0

TypeScript
GithubSyncService.getPullRequest is dead code with a misleading docstring claiming webhook fallback verification that never happens 4 days ago
bug documentation help wanted very hard Stellar Wave
MergeFi/backend
0

TypeScript
GithubWebhooksController's rawBody fallback can never byte-match what GitHub actually signed 4 days ago
bug help wanted very hard security Stellar Wave
MergeFi/backend
0

TypeScript
No controller in the codebase applies ParseUUIDPipe to :id-style route params 4 days ago
bug enhancement help wanted very hard Stellar Wave
MergeFi/backend
0

TypeScript
MilestonesService.addIssue has no milestone-status guard 4 days ago
bug enhancement help wanted very hard Stellar Wave
MergeFi/backend
0

TypeScript
resolveIssue's three sequential non-transactional writes can desync milestone.distributed from the Payment ledger, enabling a double-pay on retry 4 days ago
bug help wanted very hard architecture Stellar Wave
MergeFi/backend
0

TypeScript
milestones.service.spec.ts has zero tests for resolveIssue() or addIssue() 4 days ago
bug help wanted very hard testing Stellar Wave
MergeFi/backend
0

TypeScript
TeamsController has no controller-level test file 4 days ago
enhancement help wanted very hard testing Stellar Wave
MergeFi/backend
0

TypeScript
TeamMemberSplitDto.percentage has @IsNumber() but no @Min/@Max bound, unlike escrow's SplitRecipientDto 4 days ago
bug enhancement good first issue help wanted Stellar Wave
MergeFi/backend
0

TypeScript
MilestonesService.resolveIssue never verifies issueId belongs to milestoneId, letting any UUID drain the milestone's budget 4 days ago
bug help wanted very hard security Stellar Wave
MergeFi/backend
0

TypeScript
MilestonesService.resolveIssue's unresolvedCount fallback to 1 lets a single call drain 100% of the remaining budget 4 days ago
bug help wanted very hard security Stellar Wave
MergeFi/backend
0

TypeScript
CreateBountyDto doesn't validate that deadline is in the future 4 days ago
bug enhancement good first issue help wanted Stellar Wave
MergeFi/backend
0

TypeScript
TeamsService has no endpoint to update or remove a member split after creation 4 days ago
enhancement help wanted very hard security Stellar Wave
MergeFi/backend
0

TypeScript
computeSplitShares() in team-split.util.ts is unused dead code 4 days ago
documentation good first issue security testing Stellar Wave
MergeFi/backend
0

TypeScript
markMergedAndRelease's team-split payout path issues one userRepo.findOne() per split member instead of a single batched query 4 days ago
help wanted very hard performance architecture Stellar Wave
MergeFi/backend
0

TypeScript
JwtModule's expiresIn is cast via `as unknown as number`, masking a string/number type mismatch 4 days ago
bug good first issue help wanted architecture Stellar Wave
MergeFi/backend
0

TypeScript
bounties.service.spec.ts has no test for refund(), expireOverdue(), or the team-split branch of markMergedAndRelease() 4 days ago
enhancement good first issue help wanted testing Stellar Wave
MergeFi/backend
0

TypeScript
The bounty state machine and its own test suite document IN_REVIEW -> CLAIMED for a PR closed without merge, but nothing ever triggers it 4 days ago
bug help wanted very hard testing Stellar Wave
MergeFi/backend
0

TypeScript
Five AppConfig/stellar fields are populated from env vars but never read anywhere in the application 4 days ago
bug documentation help wanted very hard Stellar Wave
MergeFi/backend
0

TypeScript
BountiesService.markMergedAndRelease marks a team-assigned bounty PAID even when team.splits is empty, skipping the payout entirely 4 days ago
bug help wanted spike architecture Stellar Wave
MergeFi/backend
0

TypeScript
SwaggerModule serves the full OpenAPI docs UI at /api/docs unauthenticated in every environment, including production 4 days ago
bug good first issue help wanted security Stellar Wave
MergeFi/backend
0

TypeScript
IdempotencyInterceptor's 30s STALE_PROCESSING_MS window is shorter than SorobanClientService.pollTransaction's worst-case duration 4 days ago
bug help wanted very hard security Stellar Wave
MergeFi/backend
0

TypeScript
MaintenancePoolService.deposit overwrites monthlyDeposit with the latest single deposit amount on every call 4 days ago
bug documentation good first issue help wanted Stellar Wave
MergeFi/backend
0

TypeScript
EscrowService.release/refund/splitRelease/releasePartial have no try/catch around soroban.invoke, unlike fund() 4 days ago
bug help wanted spike architecture Stellar Wave
MergeFi/backend
0

TypeScript
SorobanClientService.pollTransaction never distinguishes a FAILED on-chain transaction from a SUCCESS — only NOT_FOUND vs found 4 days ago
bug help wanted very hard security Stellar Wave
MergeFi/backend
0

TypeScript
EscrowController.splitRelease returns raw Payment[] entities, bypassing the toPublicEscrow response shaping every other escrow endpoint uses 4 days ago
bug documentation good first issue security architecture Stellar Wave
MergeFi/backend
0

TypeScript
Payment.recipientId and Payment.recipientAddress are independent, unvalidated fields with no cross-check between them 4 days ago
bug help wanted very hard security Stellar Wave
MergeFi/backend
0

TypeScript
SorobanClientService has no dedicated spec file — the real invoke/poll/toScVal logic is never unit tested 4 days ago
bug help wanted very hard testing Stellar Wave
MergeFi/backend
0

TypeScript
escrow.service.spec.ts has no test coverage for releasePartial() or refund() 4 days ago
good first issue help wanted testing architecture Stellar Wave
MergeFi/backend
0

TypeScript
Escrow.status has no explicit database index despite being filtered directly in hot query paths 4 days ago
bug help wanted very hard performance Stellar Wave
MergeFi/backend
0

TypeScript
BountiesController.list's status query param has no @IsEnum validation 7 days ago
bug enhancement good first issue help wanted
MergeFi/backend
0

TypeScript
LOG_LEVEL is documented in .env.example but never read anywhere in the application 8 days ago
bug documentation help wanted very hard
MergeFi/backend
0

TypeScript
tsconfig.json enables individual strict-family flags but not the umbrella "strict": true 8 days ago
bug help wanted very hard architecture
MergeFi/backend
0

TypeScript
BountiesController.create has no @Idempotent guard, and Bounty.issueId's implicit unique constraint turns a client retry into an opaque 500 8 days ago
bug help wanted very hard architecture
MergeFi/backend
0

TypeScript
Docker/deployment tooling is entirely absent: no Dockerfile, no docker-compose for local Postgres, no CI pipeline definition about 1 month ago
documentation enhancement help wanted very hard Maybe Rewarded GrantFox OSS Official Campaign | FWC26
MergeFi/backend
0

TypeScript
Global exception handling leaks internal error details (including possible Soroban/DB error messages) to API clients about 1 month ago
bug help wanted very hard security Maybe Rewarded GrantFox OSS Official Campaign | FWC26
MergeFi/backend
0

TypeScript