> ## Documentation Index > Fetch the complete documentation index at: https://docs.istravex.com/llms.txt > Use this file to discover all available pages before exploring further. # Findings report > Every finding the kit has produced or reproduced: the affected component, severity, upstream issue, the minimal corpus entries that show it, and the failing checks it explains. Each failure the kit reproduces on purpose (an SDK release before a fix, a wallet-backend commit before a fix) maps to one of these. The same file as corpus/findings.json. ## OpenAPI ````yaml GET /v1/findings openapi: 3.1.0 info: title: Istravex API version: 1.0.0 description: >- Read-only access to the Istravex corpus: fixtures, their raw XDR, the canonical ledgers they were verified against, and the kit's results. Also hosts a mock Stellar RPC that replays the corpus for any RPC-backed indexer. license: name: Apache-2.0 url: https://www.apache.org/licenses/LICENSE-2.0 contact: url: https://github.com/hackcat29/istravex servers: - url: https://api.istravex.com description: Production - url: http://localhost:8080 description: Local (`npm run api`) security: [] tags: - name: Service - name: Fixtures - name: Ledgers - name: Results - name: RPC paths: /v1/findings: get: tags: - Results summary: Findings report description: >- Every finding the kit has produced or reproduced: the affected component, severity, upstream issue, the minimal corpus entries that show it, and the failing checks it explains. Each failure the kit reproduces on purpose (an SDK release before a fix, a wallet-backend commit before a fix) maps to one of these. The same file as corpus/findings.json. operationId: getFindings responses: '200': description: OK content: application/json: schema: type: object required: - severity_scale - findings properties: severity_scale: type: object additionalProperties: type: string findings: type: array items: type: object required: - id - title - component - severity - status - issue - fixtures - checks - reproduced - summary properties: id: type: string title: type: string component: type: string severity: enum: - critical - high - medium - low - info status: enum: - fixed-upstream - open-upstream - to-file - latent - by-design issue: type: - string - 'null' fixtures: type: array items: type: string checks: type: array items: type: string reproduced: type: - boolean - 'null' summary: type: string example: severity_scale: critical: Consensus, funds or keys at risk. high: >- Ingestion halts, or value is attributed to the wrong account. medium: >- Data is silently lost or wrong (an amount, an ID, a missing record), or a valid network value is rejected on a common path. low: >- A valid but rare value is rejected or mishandled; tooling or test infrastructure is affected. info: Behaviour worth knowing about that isn't a defect. findings: - id: ISTRAVEX-F-0001 title: Ingestion halts on a CAP-40 signed-payload signer component: stellar/wallet-backend affected: before 2c87335 (2026-09-08) fixed_in: stellar/wallet-backend#729 severity: high status: fixed-upstream issue: stellar/wallet-backend#729 cap_ids: - CAP-0040 fixtures: - cap40-signed-payload-signer-local-0001 checks: - >- pilot-sighting:cap40-signed-payload-signer-local-0001:records-persist reproduced: true summary: >- A SetOptions that adds a P… signer produces a state change whose signer column can't be encoded (68-byte key into a 33-byte AddressBytea). The COPY fails, th… evidence: >- Pilot at 2a0a84e (before): dropped, records persist: state_change.SignerAccountID … has a 68-byte key. At 2c87335 (the fix): correct. Protocol 28 corpus, kit… - id: ISTRAVEX-F-0002 title: SAC-created trustlines produce no trustline state change component: stellar/wallet-backend affected: before c152783 (2026-09-17) fixed_in: stellar/wallet-backend#734 severity: medium status: fixed-upstream issue: stellar/wallet-backend#731 cap_ids: - CAP-0073 fixtures: - cap73-sac-trust-local-0001 checks: - >- pilot-sighting:cap73-sac-trust-local-0001:trustline-state-change reproduced: true summary: >- A trustline created by the Stellar Asset Contract's trust() has no changeTrust operation; an indexer keyed on operation types records the trustline but no TR… evidence: >- Pilot at 764a4f5 (before): incorrect, TRUSTLINE state change: expected ADD, got none. At c152783 (#734): correct. - id: ISTRAVEX-F-0003 title: A Soroban operation from a muxed source halts ingestion component: stellar/wallet-backend affected: before bb0b162 (2026-09-25) fixed_in: stellar/wallet-backend#753 severity: high status: fixed-upstream issue: stellar/wallet-backend#716 cap_ids: - CAP-0046 - CAP-0027 fixtures: - cap46-muxed-soroban-source-local-0001 checks: - >- pilot-sighting:cap46-muxed-soroban-source-local-0001:records-persist - lint:wallet-backend-f8e5786:IX003 reproduced: true summary: >- The Soroban participant path added the source as M…, the classic path as G…; both encode to one primary key, the COPY fails with SQLSTATE 23505, and ingestio… evidence: >- Pilot at f8e5786 (before): dropped, participants G… and M… encode to the same key. At bb0b162 (#753): correct. istravex-lint IX003 flags the four call sites … - id: ISTRAVEX-F-0004 title: >- Soroban participants collected by unbounded recursion over the authorization tree component: stellar/wallet-backend affected: before 9538b3c (2026-09-28) fixed_in: stellar/wallet-backend@9538b3cae severity: medium status: fixed-upstream issue: stellar/wallet-backend@9538b3cae cap_ids: - CAP-0046 fixtures: - cap46-nested-auth-local-0001 checks: - lint:wallet-backend-666a64d:IX002 reproduced: true summary: >- participantsFromInvocationAndSubInvocations recursed over SorobanAuthorizedInvocation with no depth or size limit, and took participants from the authorizati… evidence: >- istravex-lint IX002 flags contract_operations.go:53 at 666a64d and not at 9538b3c, which derives Soroban participants from executed meta. The nested-auth fix… - id: ISTRAVEX-F-0005 title: >- Asset issuers and ScMap keys ordered by text instead of network order component: stellar/js-stellar-sdk affected: 17.2.0 and earlier fixed_in: 17.2.1 severity: medium status: fixed-upstream issue: stellar/js-stellar-sdk#1766 cap_ids: - CAP-0038 - CAP-0046 fixtures: - cap38-pool-issuer-order-local-0001 - cap46-scmap-host-order-local-0001 checks: - >- javascript-matrix:cap38-pool-issuer-order-local-0001:decode_pool_share_op - >- javascript-matrix:cap38-pool-issuer-order-local-0001:asset_compare - >- javascript-matrix:cap38-pool-issuer-order-local-0001:pool_id - >- javascript-matrix:cap46-scmap-host-order-local-0001:sorted_map_matches_host reproduced: true summary: >- Strkeys are base32, where 2–7 sort before A–Z in ASCII but after them in value. 17.2.0 orders issuers by strkey text, so decoding a valid pool-share changeTr… evidence: >- kit/runners/js/matrix.mjs: 17.2.0 fails the four checks; 17.2.1 and later pass. The fixture's issuers were chosen so their strkey order is the reverse of the… - id: ISTRAVEX-F-0006 title: >- Muxed and offer IDs accept values that encode a different ID component: stellar/js-stellar-sdk affected: 17.2.1 and earlier fixed_in: 17.3.0 severity: medium status: fixed-upstream issue: stellar/js-stellar-sdk#1785 cap_ids: - CAP-0027 fixtures: - cap27-muxed-max-id-local-0001 checks: - >- javascript-matrix:cap27-muxed-max-id-local-0001:muxed_id_input_canonical - >- javascript-matrix:cap27-muxed-max-id-local-0001:offer_id_input_exact reproduced: true summary: >- MuxedAccount accepts "0x…" for the maximum ID and id() then returns the string as typed, not the ID the M-address encodes; manageSellOffer rounds a numeric o… evidence: >- kit/runners/js/matrix.mjs: 17.2.0 and 17.2.1 fail both checks; 17.3.0 and later reject both inputs. - id: ISTRAVEX-F-0007 title: >- scValToNative silently drops map entries whose keys collide component: stellar/js-stellar-sdk affected: 17.2.1 and earlier fixed_in: 17.3.0 severity: medium status: fixed-upstream issue: stellar/js-stellar-sdk#1789 cap_ids: - CAP-0046 fixtures: - cap46-scmap-host-order-local-0001 checks: - >- javascript-matrix:cap46-scmap-host-order-local-0001:native_keeps_every_entry reproduced: true summary: >- u32 1 and symbol "1" are distinct ScMap keys that become the same object property; the conversion keeps the last and drops the rest with no error. evidence: >- On the fixture's real 10-entry map, 17.2.0 and 17.2.1 return 8 entries and no error; 17.3.0 and later throw. - id: ISTRAVEX-F-0008 title: >- XDR string .value getters are lossy for bytes that aren't UTF-8 component: stellar/js-stellar-sdk affected: all versions (documented behaviour since the fix) fixed_in: 17.3.0 (documentation; byte-keeping paths unchanged) severity: info status: fixed-upstream issue: stellar/js-stellar-sdk#1823 cap_ids: [] fixtures: - base-memo-non-utf8-local-0001 checks: [] reproduced: null summary: >- The network accepts any 28 bytes as memo text. The SDK's byte-keeping paths (the memo arm's bytes, Memo.fromXDRObject/toXDRObject, TransactionBuilder.fromXDR… evidence: >- All SDK versions pass memo_bytes, memo_class_roundtrip and transaction_roundtrip on a real 28-byte memo containing FF FE, a CESU-8 lone surrogate and a Latin… - id: ISTRAVEX-F-0009 title: >- Decoders reserve capacity from untrusted length prefixes and ignore vector maximums component: stellar/rs-stellar-xdr affected: 'before the fixes in #581 and #598' fixed_in: 'stellar/rs-stellar-xdr#581, #598' severity: medium status: fixed-upstream issue: stellar/rs-stellar-xdr#598 cap_ids: - CAP-0046 fixtures: - cap46-scval-limits-synthetic-0001 - base-over-max-length-synthetic-0001 checks: [] reproduced: null summary: >- A 12-byte ScVal claiming 2^32 - 1 elements, a 2,000-deep vec, 101 operations and a 29-byte memo must each be rejected cleanly. The corpus keeps them as regre… evidence: >- Synthetic fixtures with expect: decode_error; all three runners pass. Not run against pre-fix rs-stellar-xdr releases. - id: ISTRAVEX-F-0010 title: >- Operation meta lists its ledger entry changes in a different order on different runs component: stellar/stellar-core affected: >- 30.0.0 (Homebrew darwin-arm64 build; observed on standalone networks) fixed_in: null severity: low status: open-upstream issue: stellar/stellar-core#5507 cap_ids: [] fixtures: - cap38-pool-issuer-order-local-0001 checks: [] reproduced: true summary: >- Two runs of the same pinned binary on identical input (same keys, transactions and close times) produce identical ledger headers, transaction sets and result… evidence: >- Three generations of the same corpus (node kit/capture/generate.mjs --out …) give identical ledger headers for ledger 20 and three different orders of the po… - id: ISTRAVEX-F-0011 title: >- get-settings-upgrade-txs uses a random salt, so standalone networks can't be reproduced component: stellar/stellar-core affected: 30.0.0 fixed_in: null severity: low status: open-upstream issue: stellar/stellar-core#5508 cap_ids: - CAP-0046 fixtures: [] checks: [] reproduced: true summary: >- The upgrade contract is deployed with a random salt, so its contract ID, the upgrade key and every later ledger hash differ between otherwise identical runs.… evidence: kit/capture/drivers/core.mjs, deterministicUpgrade(). - id: ISTRAVEX-F-0012 title: >- TransactionBuilder refuses a muxed source or memo on every Soroban transaction component: stellar/js-stellar-sdk affected: 17.4.0 fixed_in: null severity: low status: open-upstream issue: stellar/js-stellar-sdk#1906 cap_ids: - CAP-0046 - CAP-0027 fixtures: - cap46-muxed-soroban-source-local-0001 checks: [] reproduced: true summary: >- TransactionBuilder throws "Soroban transactions cannot use a muxed source account" (and refuses a muxed operation source or any memo) for every Soroban trans… evidence: >- The generator sets the muxed source on the raw XDR to build the fixture (kit/capture/drivers/core.mjs, rawMuxedSource). - id: ISTRAVEX-F-0013 title: Memo text returned as a Go string without UTF-8 validation component: stellar/wallet-backend affected: main @ 3e22515 fixed_in: null severity: low status: latent issue: null cap_ids: [] fixtures: - base-memo-non-utf8-local-0001 checks: - lint:wallet-backend-3e22515:IX001 reproduced: null summary: >- utils.Memo returns MEMO_TEXT as a string with no UTF-8 check. Nothing outside tests calls it and no table has a memo column, so it isn't reachable today. Wor… evidence: >- istravex-lint IX001 at internal/utils/ingestion_utils.go:17; triaged in kit/pilot/wallet-backend/triage.json. - id: ISTRAVEX-F-0014 title: Fee-processing changes over-count Soroban fees component: stellar/stellar-core affected: protocol 23 and later fixed_in: null severity: info status: by-design issue: null cap_ids: - CAP-0046 fixtures: - cap15-fee-bump-pubnet-0001 checks: [] reproduced: null summary: >- On the fee-bump fixture the fee-processing changes debit 46,340 stroops but FeeCharged is 40,354: the Soroban refund settles after apply. Fees computed from … evidence: kit/replay/replay.mjs, feeMetaDebit on the reference row. - id: ISTRAVEX-F-0015 title: >- Diagnostic events differ between RPC nodes for the same ledger component: stellar/stellar-rpc affected: testnet nodes, 2026-11 fixed_in: null severity: info status: by-design issue: null cap_ids: - CAP-0046 fixtures: [] checks: [] reproduced: null summary: >- The same transaction's meta differed in one diagnostic value (core_metrics invoke_time_nsecs, 188,866 vs 126,592 ns) between two nodes. Diagnostic events are… evidence: >- kit/capture/canonicalize.mjs; the verifier explains a diagnostic-only difference when it sees one. '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/Error' example: error: code: not_found message: Fixture not found '429': description: Rate limited headers: Retry-After: schema: type: integer content: application/json: schema: $ref: '#/components/schemas/Error' components: schemas: Error: type: object required: - error properties: error: type: object required: - code - message properties: code: type: string message: type: string ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.