Security, Precision, and Performance: A Week in Review

[collinsezedike]

A batch of fixes shipped this week covering API hardening, arithmetic precision, position fetch performance, and several smaller correctness patches.

API hardening (#295)
The Fastify API now enforces per-route rate limits on the two transaction routes: /tx/deposit and /tx/withdraw are capped at 10 requests per minute per IP, tighter than the 100/min global. Previously only the global limit applied. All routes now reject bodies over 10 KB and attach X-Content-Type-Options: nosniff and X-Frame-Options: DENY to every response.

Position precision (#294)
Share balances, deposited values, and earned yield are now computed using integer-safe bigint arithmetic. Previously, the code divided raw stroops by a floating-point constant, which silently loses precision for balances above ~92 million USDC. Numbers are now kept in bigint until the final conversion.

Parallelized position fetch (#293)
Blend and DeFindex position fetches now run concurrently with Promise.all. Previously they ran serially, doubling the response time for wallets that hold positions in both protocols.

Smaller fixes (#288, #290, #291, #292)
KNOWN_POOLS is now exported from @meridian/stellar-sdk-helpers (it was missing from the package index). The DeFindex configured check is evaluated per request rather than once at module load, so a runtime DEFINDEX_VAULT_ID takes effect without a restart. The default CORS origin and shared types are now centralized in @meridian/shared instead of being redeclared across handlers.

Back to building.
— Collins