ADAMANT Explorer v2.0.0: Vue 3, hardened API boundaries, and resilient live monitoring

[adamantmm]

ADAMANT Explorer v2.0.0 is the first stable release since v1.3.0. It consolidates 218 commits and 491 changed files into a major frontend, backend, live-monitoring, security, and operations update while preserving existing public Explorer routes and deep links.

This post focuses on the implementation and upgrade impact. The complete release is available in GitHub Releases.

Frontend architecture

The legacy AngularJS, Bootstrap 3, and Webpack application has been replaced with:

• Vue 3 single-file components
• Pinia for shared network state
• Vue Router 5 with compatibility for existing URLs
• Vite 8 for development and production builds
• Framework-independent utilities in src/lib/ that can be tested directly in Node.js

All main views were rebuilt: home, blocks, transactions, addresses, delegates, Top Accounts, Reserved Wallets, Delegate Monitor, Network Monitor, and Activity Graph. The UI now includes persistent light and dark themes, responsive tables and transaction cards, accessible controls, safer tooltips, deterministic transaction ordering, contextual operation types, and full-precision ADM presentation where ledger accuracy matters.

The responsive work is described in more detail in ADAMANT Explorer: mobile and small-screen UX overhaul.

ADAMANT Node and API boundary

All ADAMANT Node interaction now goes through adamant-api 3.1.0 in the dedicated request-adapter layer. The backend adds startup-readiness gating, node failover, normalized SDK failures, bounded pagination, strict route/query validation, and separate request, normalization, and response-assembly layers.

The Explorer exposes only the 12 same-origin routes required by its UI plus GET /api/networkHealth. Sixteen unsupported legacy Explorer endpoints, arbitrary transaction-filter passthrough, wildcard CORS, and obsolete Market Watcher routes were removed.

The reduced API surface is an implementation boundary for the Explorer UI, not a general-purpose public integration API. External applications should use adamant-api-jsclient. Operational monitoring can use GET /api/networkHealth, which reports coherent live, degraded, critical, or unavailable states.

Live monitoring and cache consistency

The four public Socket.IO namespaces—Header, Delegate Monitor, Network Monitor, and Activity Graph—now use serialized polling, lifecycle generations, bounded retries, and stale-callback protection.

Additional runtime changes include:

• Block-driven refreshes for open Home and Blocks views instead of fixed freshness delays
• REST hydration and bounded confirmation of compact WebSocket block notifications
• Stable delegate schedule, forging-state, reward, fee, and round-boundary calculations
• Coherent rolling block and peer statistics with optional Redis persistence
• Correct cache identity for new blocks and same-height fork replacements
• Bounded GeoJS peer geo-location with cached normalization and hostname-only degradation
• A validated, cached, timeout-bound, and per-IP-limited OpenStreetMap tile proxy for clearnet and Tor deployments

Redis remains recommended for response caching and persisted statistics, but Redis failures no longer take down core HTTP or static serving.

Security and privacy hardening

The public request and browser boundaries now include:

• Exact API surface enforcement before cache and ADAMANT readiness work
• Strict validation for addresses, uint64 identifiers, pagination, routes, methods, and filters
• An in-process fixed-window API limiter with proxy-aware client identity and a fail-closed overflow bucket
• Validated trustedProxies configuration
• Security headers, a constrained Content Security Policy, stable public errors, and explicit HTTP timeouts
• Query-string-minimized access logs
• Text-only rendering and validation for Node- and peer-controlled Network Monitor values
• Graceful degradation for Redis, Node, exchange-rate, geo-location, and tile-provider failures

The repository includes a versioned threat model and security and reliability review. More details are available in ADAMANT Explorer security and reliability review by cryptofoundry.

Security audited by cryptofoundry.

Runtime and deployment changes

Operators upgrading from v1.3.0 should review the following changes:

• Node.js ^22.18.0 || >=24.11.0 is required
• Configured ADAMANT Nodes must run v0.10.2 or newer
• A new config.jsonc should be prepared from config.default.jsonc, especially nodes_adm, trustedProxies, redis, geoLocation, exchangeRates, and log_level
• Freegeoip has been replaced by optional GeoJS integration; disabling geo-location keeps peer and hostname data without provider-derived map data
• Reverse proxies and firewalls must allow the same-origin /osm-tiles/ path
• Generated public/ assets are not committed and must be built during deployment with npm run build
• npm run dev starts the backend and Vite together; npm run dev:frontend starts Vite only

Validation

The released source tree passed:

• ESLint and Prettier checks
• Production build with 6,337 transformed modules
• 226 Node-only unit tests
• 41 live ADAMANT Testnet API tests
• Full and production-only dependency audits with zero reported vulnerabilities
• Browser smoke checks across 13 routes at desktop, tablet, and mobile resolutions without console errors or horizontal overflow

References

• ADAMANT Explorer v2.0.0 release
• Release pull request #47
• Release issue #46
• Full v1.3.0...v2.0.0 changelog
• Repository and self-hosting documentation