Atomic rebalancing, testnet deposits, and distributed rate limiting: A Week in Review

[collinsezedike]

Three milestones since the last update.

Soroban router contract (#299)

A MeridianRouter contract is now in the repo. A single rebalance(depositor, from_vault, to_vault, shares, min_out, route_to) call withdraws from one Meridian vault and deposits into another within one transaction. depositor.require_auth() covers both legs via Soroban's auth tree, so the user signs once. A slippage guard panics and reverts the whole transaction when the withdrawal falls short of min_out, so the deposit leg can only execute if the withdrawal succeeds.

Testnet deposits working end to end (#297)

The deposit transaction was broken. CONTRACT_ADDRESSES.testnet.blend.pool held a 54-character StrKey (Stellar contract addresses are 56 characters). All testnet addresses are now correct: Blend TestnetV2 pool, Blend-issued USDC SAC, and Circle's EURC SAC. @stellar/stellar-sdk is bumped to ^14.0.0 to resolve the dual stellar-base version that blend-sdk was introducing. deposit also now auto-funds a testnet wallet from Blend's public faucet when the USDC balance is zero, removing the manual step for first-time testers.

Distributed rate limiting (#303)

The Vercel rate limiter was backed by an in-memory Map, which means each serverless worker instance had its own counter. A user hitting two different instances could exceed the limit without being capped. The limiter now uses @upstash/ratelimit with a Redis sliding window so the limit is enforced globally across all instances. The in-memory path is kept as a fallback when Redis env vars are absent, so local dev works without credentials.

Back to building.
— Collins