v2.1.0 — Multi-Chain, Admin Panel, Security Hardening

What's New

Multi-Chain Support

• 5 chains: EVM, Solana, Bitcoin, Tron, Cosmos with wallet address auto-detection
• Chain auto-switch: dropdown follows detected address as you type
• Cross-chain detection: flags payouts where recipient chain differs from treasury (EVM), tracks bridge status
• Block explorer links: clickable tx/address links to Etherscan, Solscan, Mempool.space, Tronscan, Mintscan
• Per-chain treasury display: each signed payout shows the matching treasury address

Admin Review Panel

• Inline approve/reject directly from the dashboard (no curl needed)
• Adjustable payout amount before approving — admin can modify the suggested reward
• Inline rejection reason input (no browser popups)
• Admin toggle button with token entry
• Demo admin token: admin

Security Hardening

• Atomic daily budget check via SQLite transactions (race condition fix)
• SSE per-IP connection limits + dead connection cleanup via heartbeat
• SSE auto-reconnect with exponential backoff (frontend)
• CSP hardened: removed unsafe-inline, added HSTS, Permissions-Policy
• Admin rate limiting (20 req/min)
• Status filter validation (rejects arbitrary strings)
• Signing retry endpoint with audit trail
• Tron/Solana detection order fix (Tron checked before Solana catch-all)
• Bridge fields in all transaction paths (review + retry-sign)

Dashboard Improvements

• Click-to-expand report details with audit trail timeline
• Character counter on description field (0/5000)
• Toast notifications on submit success/failure
• 18 randomized demo reports including Solana/Tron wallets
• Reset button sends admin token correctly
• Demo buttons trigger chain auto-detection
• Title input maxlength enforced (200 chars)
• Focus-visible outlines, reduced-motion support, mobile breakpoints

New Endpoints

• GET /api/health — health check (pings database)
• POST /api/report/:id/retry-sign — retry signing for approved reports (admin)
• GET /api/reports/export — CSV export (admin)

Bug Fixes

• Reset button silently failing (missing auth header)
• Demo fill not triggering chain detection
• Bridge fields missing in manual review and retry-sign transactions
• Wallet API only showing EVM (now shows all chains)
• Tron addresses misdetected as Solana

Stats

• 24 integration tests
• 18 API endpoints
• 5 supported chains
• 30+ commits since v2.0.0

Contributors

• @dieutx
• @binhnt92
• @LoveMath95