Findings report

curl --request GET \
  --url https://api.istravex.com/v1/findings

const options = {method: 'GET'};

fetch('https://api.istravex.com/v1/findings', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.istravex.com/v1/findings"

	req, _ := http.NewRequest("GET", url, nil)

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

import requests

url = "https://api.istravex.com/v1/findings"

response = requests.get(url)

print(response.text)

{
  "severity_scale": {
    "critical": "Consensus, funds or keys at risk.",
    "high": "Ingestion halts, or value is attributed to the wrong account.",
    "medium": "Data is silently lost or wrong (an amount, an ID, a missing record), or a valid network value is rejected on a common path.",
    "low": "A valid but rare value is rejected or mishandled; tooling or test infrastructure is affected.",
    "info": "Behaviour worth knowing about that isn't a defect."
  },
  "findings": [
    {
      "id": "ISTRAVEX-F-0001",
      "title": "Ingestion halts on a CAP-40 signed-payload signer",
      "component": "stellar/wallet-backend",
      "affected": "before 2c87335 (2026-09-08)",
      "fixed_in": "stellar/wallet-backend#729",
      "severity": "high",
      "status": "fixed-upstream",
      "issue": "stellar/wallet-backend#729",
      "cap_ids": [
        "CAP-0040"
      ],
      "fixtures": [
        "cap40-signed-payload-signer-local-0001"
      ],
      "checks": [
        "pilot-sighting:cap40-signed-payload-signer-local-0001:records-persist"
      ],
      "reproduced": true,
      "summary": "A SetOptions that adds a P… signer produces a state change whose signer column can't be encoded (68-byte key into a 33-byte AddressBytea). The COPY fails, th…",
      "evidence": "Pilot at 2a0a84e (before): dropped, records persist: state_change.SignerAccountID … has a 68-byte key. At 2c87335 (the fix): correct. Protocol 28 corpus, kit…"
    },
    {
      "id": "ISTRAVEX-F-0002",
      "title": "SAC-created trustlines produce no trustline state change",
      "component": "stellar/wallet-backend",
      "affected": "before c152783 (2026-09-17)",
      "fixed_in": "stellar/wallet-backend#734",
      "severity": "medium",
      "status": "fixed-upstream",
      "issue": "stellar/wallet-backend#731",
      "cap_ids": [
        "CAP-0073"
      ],
      "fixtures": [
        "cap73-sac-trust-local-0001"
      ],
      "checks": [
        "pilot-sighting:cap73-sac-trust-local-0001:trustline-state-change"
      ],
      "reproduced": true,
      "summary": "A trustline created by the Stellar Asset Contract's trust() has no changeTrust operation; an indexer keyed on operation types records the trustline but no TR…",
      "evidence": "Pilot at 764a4f5 (before): incorrect, TRUSTLINE state change: expected ADD, got none. At c152783 (#734): correct."
    },
    {
      "id": "ISTRAVEX-F-0003",
      "title": "A Soroban operation from a muxed source halts ingestion",
      "component": "stellar/wallet-backend",
      "affected": "before bb0b162 (2026-09-25)",
      "fixed_in": "stellar/wallet-backend#753",
      "severity": "high",
      "status": "fixed-upstream",
      "issue": "stellar/wallet-backend#716",
      "cap_ids": [
        "CAP-0046",
        "CAP-0027"
      ],
      "fixtures": [
        "cap46-muxed-soroban-source-local-0001"
      ],
      "checks": [
        "pilot-sighting:cap46-muxed-soroban-source-local-0001:records-persist",
        "lint:wallet-backend-f8e5786:IX003"
      ],
      "reproduced": true,
      "summary": "The Soroban participant path added the source as M…, the classic path as G…; both encode to one primary key, the COPY fails with SQLSTATE 23505, and ingestio…",
      "evidence": "Pilot at f8e5786 (before): dropped, participants G… and M… encode to the same key. At bb0b162 (#753): correct. istravex-lint IX003 flags the four call sites …"
    },
    {
      "id": "ISTRAVEX-F-0004",
      "title": "Soroban participants collected by unbounded recursion over the authorization tree",
      "component": "stellar/wallet-backend",
      "affected": "before 9538b3c (2026-09-28)",
      "fixed_in": "stellar/wallet-backend@9538b3cae",
      "severity": "medium",
      "status": "fixed-upstream",
      "issue": "stellar/wallet-backend@9538b3cae",
      "cap_ids": [
        "CAP-0046"
      ],
      "fixtures": [
        "cap46-nested-auth-local-0001"
      ],
      "checks": [
        "lint:wallet-backend-666a64d:IX002"
      ],
      "reproduced": true,
      "summary": "participantsFromInvocationAndSubInvocations recursed over SorobanAuthorizedInvocation with no depth or size limit, and took participants from the authorizati…",
      "evidence": "istravex-lint IX002 flags contract_operations.go:53 at 666a64d and not at 9538b3c, which derives Soroban participants from executed meta. The nested-auth fix…"
    },
    {
      "id": "ISTRAVEX-F-0005",
      "title": "Asset issuers and ScMap keys ordered by text instead of network order",
      "component": "stellar/js-stellar-sdk",
      "affected": "17.2.0 and earlier",
      "fixed_in": "17.2.1",
      "severity": "medium",
      "status": "fixed-upstream",
      "issue": "stellar/js-stellar-sdk#1766",
      "cap_ids": [
        "CAP-0038",
        "CAP-0046"
      ],
      "fixtures": [
        "cap38-pool-issuer-order-local-0001",
        "cap46-scmap-host-order-local-0001"
      ],
      "checks": [
        "javascript-matrix:cap38-pool-issuer-order-local-0001:decode_pool_share_op",
        "javascript-matrix:cap38-pool-issuer-order-local-0001:asset_compare",
        "javascript-matrix:cap38-pool-issuer-order-local-0001:pool_id",
        "javascript-matrix:cap46-scmap-host-order-local-0001:sorted_map_matches_host"
      ],
      "reproduced": true,
      "summary": "Strkeys are base32, where 2–7 sort before A–Z in ASCII but after them in value. 17.2.0 orders issuers by strkey text, so decoding a valid pool-share changeTr…",
      "evidence": "kit/runners/js/matrix.mjs: 17.2.0 fails the four checks; 17.2.1 and later pass. The fixture's issuers were chosen so their strkey order is the reverse of the…"
    },
    {
      "id": "ISTRAVEX-F-0006",
      "title": "Muxed and offer IDs accept values that encode a different ID",
      "component": "stellar/js-stellar-sdk",
      "affected": "17.2.1 and earlier",
      "fixed_in": "17.3.0",
      "severity": "medium",
      "status": "fixed-upstream",
      "issue": "stellar/js-stellar-sdk#1785",
      "cap_ids": [
        "CAP-0027"
      ],
      "fixtures": [
        "cap27-muxed-max-id-local-0001"
      ],
      "checks": [
        "javascript-matrix:cap27-muxed-max-id-local-0001:muxed_id_input_canonical",
        "javascript-matrix:cap27-muxed-max-id-local-0001:offer_id_input_exact"
      ],
      "reproduced": true,
      "summary": "MuxedAccount accepts \"0x…\" for the maximum ID and id() then returns the string as typed, not the ID the M-address encodes; manageSellOffer rounds a numeric o…",
      "evidence": "kit/runners/js/matrix.mjs: 17.2.0 and 17.2.1 fail both checks; 17.3.0 and later reject both inputs."
    },
    {
      "id": "ISTRAVEX-F-0007",
      "title": "scValToNative silently drops map entries whose keys collide",
      "component": "stellar/js-stellar-sdk",
      "affected": "17.2.1 and earlier",
      "fixed_in": "17.3.0",
      "severity": "medium",
      "status": "fixed-upstream",
      "issue": "stellar/js-stellar-sdk#1789",
      "cap_ids": [
        "CAP-0046"
      ],
      "fixtures": [
        "cap46-scmap-host-order-local-0001"
      ],
      "checks": [
        "javascript-matrix:cap46-scmap-host-order-local-0001:native_keeps_every_entry"
      ],
      "reproduced": true,
      "summary": "u32 1 and symbol \"1\" are distinct ScMap keys that become the same object property; the conversion keeps the last and drops the rest with no error.",
      "evidence": "On the fixture's real 10-entry map, 17.2.0 and 17.2.1 return 8 entries and no error; 17.3.0 and later throw."
    },
    {
      "id": "ISTRAVEX-F-0008",
      "title": "XDR string .value getters are lossy for bytes that aren't UTF-8",
      "component": "stellar/js-stellar-sdk",
      "affected": "all versions (documented behaviour since the fix)",
      "fixed_in": "17.3.0 (documentation; byte-keeping paths unchanged)",
      "severity": "info",
      "status": "fixed-upstream",
      "issue": "stellar/js-stellar-sdk#1823",
      "cap_ids": [],
      "fixtures": [
        "base-memo-non-utf8-local-0001"
      ],
      "checks": [],
      "reproduced": null,
      "summary": "The network accepts any 28 bytes as memo text. The SDK's byte-keeping paths (the memo arm's bytes, Memo.fromXDRObject/toXDRObject, TransactionBuilder.fromXDR…",
      "evidence": "All SDK versions pass memo_bytes, memo_class_roundtrip and transaction_roundtrip on a real 28-byte memo containing FF FE, a CESU-8 lone surrogate and a Latin…"
    },
    {
      "id": "ISTRAVEX-F-0009",
      "title": "Decoders reserve capacity from untrusted length prefixes and ignore vector maximums",
      "component": "stellar/rs-stellar-xdr",
      "affected": "before the fixes in #581 and #598",
      "fixed_in": "stellar/rs-stellar-xdr#581, #598",
      "severity": "medium",
      "status": "fixed-upstream",
      "issue": "stellar/rs-stellar-xdr#598",
      "cap_ids": [
        "CAP-0046"
      ],
      "fixtures": [
        "cap46-scval-limits-synthetic-0001",
        "base-over-max-length-synthetic-0001"
      ],
      "checks": [],
      "reproduced": null,
      "summary": "A 12-byte ScVal claiming 2^32 - 1 elements, a 2,000-deep vec, 101 operations and a 29-byte memo must each be rejected cleanly. The corpus keeps them as regre…",
      "evidence": "Synthetic fixtures with expect: decode_error; all three runners pass. Not run against pre-fix rs-stellar-xdr releases."
    },
    {
      "id": "ISTRAVEX-F-0010",
      "title": "Operation meta lists its ledger entry changes in a different order on different runs",
      "component": "stellar/stellar-core",
      "affected": "30.0.0 (Homebrew darwin-arm64 build; observed on standalone networks)",
      "fixed_in": null,
      "severity": "low",
      "status": "open-upstream",
      "issue": "stellar/stellar-core#5507",
      "cap_ids": [],
      "fixtures": [
        "cap38-pool-issuer-order-local-0001"
      ],
      "checks": [],
      "reproduced": true,
      "summary": "Two runs of the same pinned binary on identical input (same keys, transactions and close times) produce identical ledger headers, transaction sets and result…",
      "evidence": "Three generations of the same corpus (node kit/capture/generate.mjs --out …) give identical ledger headers for ledger 20 and three different orders of the po…"
    },
    {
      "id": "ISTRAVEX-F-0011",
      "title": "get-settings-upgrade-txs uses a random salt, so standalone networks can't be reproduced",
      "component": "stellar/stellar-core",
      "affected": "30.0.0",
      "fixed_in": null,
      "severity": "low",
      "status": "open-upstream",
      "issue": "stellar/stellar-core#5508",
      "cap_ids": [
        "CAP-0046"
      ],
      "fixtures": [],
      "checks": [],
      "reproduced": true,
      "summary": "The upgrade contract is deployed with a random salt, so its contract ID, the upgrade key and every later ledger hash differ between otherwise identical runs.…",
      "evidence": "kit/capture/drivers/core.mjs, deterministicUpgrade()."
    },
    {
      "id": "ISTRAVEX-F-0012",
      "title": "TransactionBuilder refuses a muxed source or memo on every Soroban transaction",
      "component": "stellar/js-stellar-sdk",
      "affected": "17.4.0",
      "fixed_in": null,
      "severity": "low",
      "status": "open-upstream",
      "issue": "stellar/js-stellar-sdk#1906",
      "cap_ids": [
        "CAP-0046",
        "CAP-0027"
      ],
      "fixtures": [
        "cap46-muxed-soroban-source-local-0001"
      ],
      "checks": [],
      "reproduced": true,
      "summary": "TransactionBuilder throws \"Soroban transactions cannot use a muxed source account\" (and refuses a muxed operation source or any memo) for every Soroban trans…",
      "evidence": "The generator sets the muxed source on the raw XDR to build the fixture (kit/capture/drivers/core.mjs, rawMuxedSource)."
    },
    {
      "id": "ISTRAVEX-F-0013",
      "title": "Memo text returned as a Go string without UTF-8 validation",
      "component": "stellar/wallet-backend",
      "affected": "main @ 3e22515",
      "fixed_in": null,
      "severity": "low",
      "status": "latent",
      "issue": null,
      "cap_ids": [],
      "fixtures": [
        "base-memo-non-utf8-local-0001"
      ],
      "checks": [
        "lint:wallet-backend-3e22515:IX001"
      ],
      "reproduced": null,
      "summary": "utils.Memo returns MEMO_TEXT as a string with no UTF-8 check. Nothing outside tests calls it and no table has a memo column, so it isn't reachable today. Wor…",
      "evidence": "istravex-lint IX001 at internal/utils/ingestion_utils.go:17; triaged in kit/pilot/wallet-backend/triage.json."
    },
    {
      "id": "ISTRAVEX-F-0014",
      "title": "Fee-processing changes over-count Soroban fees",
      "component": "stellar/stellar-core",
      "affected": "protocol 23 and later",
      "fixed_in": null,
      "severity": "info",
      "status": "by-design",
      "issue": null,
      "cap_ids": [
        "CAP-0046"
      ],
      "fixtures": [
        "cap15-fee-bump-pubnet-0001"
      ],
      "checks": [],
      "reproduced": null,
      "summary": "On the fee-bump fixture the fee-processing changes debit 46,340 stroops but FeeCharged is 40,354: the Soroban refund settles after apply. Fees computed from …",
      "evidence": "kit/replay/replay.mjs, feeMetaDebit on the reference row."
    },
    {
      "id": "ISTRAVEX-F-0015",
      "title": "Diagnostic events differ between RPC nodes for the same ledger",
      "component": "stellar/stellar-rpc",
      "affected": "testnet nodes, 2026-11",
      "fixed_in": null,
      "severity": "info",
      "status": "by-design",
      "issue": null,
      "cap_ids": [
        "CAP-0046"
      ],
      "fixtures": [],
      "checks": [],
      "reproduced": null,
      "summary": "The same transaction's meta differed in one diagnostic value (core_metrics invoke_time_nsecs, 188,866 vs 126,592 ns) between two nodes. Diagnostic events are…",
      "evidence": "kit/capture/canonicalize.mjs; the verifier explains a diagnostic-only difference when it sees one."
    }
  ]
}

{
  "error": {
    "code": "not_found",
    "message": "Fixture not found"
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>"
  }
}