Skip to main content

Audit Log

Internal Document

This page records the implementation history of audit findings and fixes. It is intended for maintainers, not end users.

Audit Round 1 — Production Security Audit​

Date: 2025-10-24 Source: production-audit-report.md, AUDIT_IMPLEMENTATION_SUMMARY.md

Critical Priority — Completed​

API Route Authentication and Rate Limiting​

All unprotected API routes received authentication and in-memory rate limiting.

FileChange
src/lib/auth.tsNew: authenticateRequest utility with localhost dev bypass
src/lib/rate-limit.tsNew: In-memory per-IP rate limiter, configurable per-route
src/app/api/1inch/eth_rpc/route.tsAdded auth + rate limit (10 req/min)
src/app/api/lifi/routes/route.tsAdded auth + rate limit
src/app/api/1inch/gas/route.tsAdded auth + rate limit

RPC Method Allowlist​

The /api/1inch/eth_rpc route now enforces a strict allowlist of 14 read-only Ethereum methods. eth_sendRawTransaction and all write methods return 403.

Allowed methods:

eth_call, eth_getBalance, eth_getBlockByNumber, eth_getBlockByHash,
eth_getTransactionByHash, eth_getTransactionReceipt, eth_getLogs,
eth_gasPrice, eth_estimateGas, eth_getCode, eth_getStorageAt,
eth_getTransactionCount, eth_chainId, eth_blockNumber

Medium Priority — Completed​

State Management — Stale Closures​

src/components/cli.tsx contained stale closure bugs in 4+ setTabs calls. All were rewritten to use the functional update form (setTabs(prev => ...)), eliminating dropped history items under concurrent tab updates.

Plugin Loading — Synchronization​

Plugin loading now blocks command dispatch until fully initialized. A loading state and command queue were added to cli.tsx. Users see a loading indicator on startup rather than commands silently failing.

Production Logging Sanitization​

Unconditional console.log calls in 4 API routes removed or gated behind process.env.NODE_ENV === 'development' checks. Wallet state and protocol data no longer appear in production logs.

Chain Configuration​

src/lib/chains.ts created as a centralized chain configuration with 7 supported chains and protocol-specific mappings. Replaces hardcoded chain maps scattered across plugin files. Unknown chain IDs now return a helpful error message instead of silently failing.

Swap Command Status​

The swap command in cli.tsx was previously missing; it now returns a clear "COMING SOON" message. The Uniswap v4 integration is still in progress. See Uniswap v4 for current status.

Deferred — Architectural​

Server-Side Plugin Execution​

Client-side plugins (the current architecture) expose API keys if the client is inspected. Moving plugin execution server-side requires a separate plugin execution API with signed request semantics. Deferred to a dedicated milestone.

Current risk: API keys bundled in client JavaScript are visible to users. Mitigated by the API route authentication layer — but the underlying concern remains until server-side plugin execution is implemented.

Audit Round 2 — Core Plugin Integration Audit​

Date: 2026-02-13 Source: CORE_PLUGIN_INTEGRATION_AUDIT.md, review_overview_feb13.md

Findings (not yet fully resolved)​

See Known Issues for the current state of issues from this audit.

Key findings:

  • Missing handlers for several declared commands across plugins
  • protocolState write patterns inconsistent across plugins
  • addCommandToFiber scope validation gaps
  • Handler-based commands bypass unified context/history update
  • Aave v3 and Uniswap v4 commands not fully wired

Audit Round 3 — CLI Hardening and Execution Engine Review​

Date: 2026-02-14 Source: notes_feb14.md

Position​

The CLI hardening audit identified structural limitations that must be resolved before the pipeline DSL can be shipped safely:

  1. Handlers return Promise<void> — no structured output for chaining.
  2. Handler path skips unified context/history update.
  3. Global isExecuting lock drops commands under load.
  4. Parser insufficient for DSL grammar (&&, => $var, quoting).
  5. No execution-scoped variable store.

Phase 0 Hardening Plan​

Five items approved for immediate implementation before DSL work:

  1. Add HandlerResult contract with pipelineOutput.
  2. Guarantee context update for all execution paths.
  3. Replace global lock with per-tab FIFO queue.
  4. Extract command parse/resolve/execute from cli.tsx into an ExecutionEngine module.
  5. Add typed runtime event model (quote_ready, tx_requested, tx_sent, tx_confirmed, error).

Status: Not yet implemented. See Roadmap for tracking.

Open Deployment Checklist​

Before deploying to a shared or production environment:

  • Set ONEINCH_API_KEY in deployment environment
  • Set CLIENT_API_KEY to a secure random string
  • Set NODE_ENV=production
  • Confirm client code includes x-api-key header on all API calls
  • Test rate limiting behavior (should return 429 after threshold)
  • Verify no sensitive data in server logs
  • Confirm plugin loading UX (loading indicator shows, commands queue)
  • Test unsupported chain error messages
  • Confirm analytics endpoints are protected (currently open — see Security Findings)