ADAMANT Explorer security and reliability review by cryptofoundry

[adamantmm]

ADAMANT Explorer has completed a focused security and reliability review of its public HTTP surface, ADAMANT Node boundary, Redis cache behavior, Socket.IO lifecycle, reverse-proxy trust, and browser rendering.

Security audited by CryptoFoundry.

The hardening was merged in adamant-explorer#37 and completes #23, #25, and #33.

Review scope

• Express middleware ordering, public API exposure, validation, and rate limiting
• Reverse-proxy trust and forwarded client identity
• ADAMANT Node responses as an untrusted data boundary
• Redis cache correctness and failure behavior
• Socket.IO polling, reconnects, retry scheduling, and timer ownership
• Browser rendering of Node- and peer-controlled values
• Optional dependency failures, exchange-rate continuity, and operational health reporting
• Repository documentation, threat modeling, and focused regression coverage

Main hardening changes

Public HTTP and API boundary

Explorer now exposes only the 12 same-origin API routes required by its UI, plus GET /api/networkHealth. Sixteen legacy route registrations and wildcard CORS were removed. Requests are checked against an exact API surface before Redis lookup or ADAMANT readiness checks, preventing removed endpoints from being revived through stale cache entries.

Public query parameters now use strict validation and bounded pagination. The application also applies a proxy-aware, in-process fixed-window limit of 300 API requests per minute per client, with bounded identity storage and a fail-closed overflow bucket.

Reverse-proxy trust is explicit and validated. Security headers, a constrained Content Security Policy, stable error responses, HTTP timeouts, and data-minimized request logging further reduce the exposed attack surface.

Availability and state correctness

GET /api/networkHealth reports coherent live, degraded, critical, or unavailable states. It returns HTTP 503 only when no coherent Node snapshot can be produced.

Redis and optional external-service failures no longer take down core HTTP and static serving. Cache identity is block-sensitive where required, and the exchange-rate refresh path preserves usable last-known values while avoiding overlapping refreshes.

Socket.IO polling is serialized, lifecycle-aware, and bounded during upstream failures. Generation tracking, explicit timer ownership, and stale-callback suppression prevent disconnected or restarted namespaces from continuing obsolete work.

Untrusted data and browser safety

ADAMANT Node and peer payloads remain untrusted until normalized or validated. Network Monitor values are rendered as text, while route targets, CSS-derived values, and coordinates are constrained before use. Frontend and backend API paths now share one source of truth to prevent contract drift.

Compatibility and integration impact

The retained Explorer API is an implementation detail of the web UI, not a general-purpose integration API. External applications should use adamant-api-jsclient for direct ADAMANT Node integration. Operators can use GET /api/networkHealth for Explorer monitoring.

Existing frontend routes and deep links remain compatible. Deployments behind a reverse proxy must configure trustedProxies to match the actual topology. HTTPS Nodes are preferred; one legacy plaintext HTTP fallback remains for compatibility.

Evidence and follow-up work

• Repository threat model
• Security and reliability review
• Merged implementation and validation plan
• Optional peer-IP privacy controls
• Major frontend dependency upgrades
• Successful ADAMANT Node response-schema validation
• Outage retry and log coalescing

This was a repository code and architecture audit of Explorer and its runtime trust boundaries. It was not a cryptographic-protocol or blockchain-consensus audit. The rate limiter is intentionally per process, so multi-replica deployments should also enforce an aggregate limit at the edge.

Feedback from Explorer operators and ecosystem integrators is welcome, especially on reverse-proxy topology, health monitoring, migration from legacy Explorer endpoints, and the remaining follow-up risks.