Currencyinfo 4.2.0: keyless by default, a rebuilt source layer, and history queries 2850× faster

[metalisk]

Currencyinfo 4.2.0 is out. It is the largest release the project has had: 45 commits, 133 files, and a rebuilt rate source layer.

This post is the technical version — what changed under the hood and why. The release notes carry the upgrade checklist.

Security audited by cryptofoundry.

docker pull ghcr.io/adamant-im/currencyinfo:4.2.0

---

Why the source layer was rebuilt

Two upstream free tiers disappeared. CryptoCompare retired its free plan on 21 May 2026 and min-api.cryptocompare.com now answers 401 without a subscription. CoinGecko's keyless public plan became unusable in practice: it throttles to 5–15 calls per minute and rate-limits unpredictably.

On 4.1.x those two were the only free crypto sources. A stock configuration was therefore left with no working crypto coverage at all, and — worse — it failed on every refresh cycle rather than failing loudly once.

4.2.0 answers that with four new connectors, all keyless, and a default configuration that actually works with no credential:

Source	Type	Cost per cycle
CoinPaprika	aggregator	1 bulk call + 1 per out-of-range coin
CoinLore	aggregator	1 multi-ID call
Binance	exchange	1 call
ExchangeRate-API	fiat	1 call
Currency API	fiat	1 call

Three keyless crypto sources and two keyless fiat sources means minSources: 2 is satisfiable out of the box. We verified this end to end in CI: docker-ci.yml boots the image against the shipped config.default.jsonc on every pull request and asserts it returns real rates without an API key.

Source independence, not just source count

Adding aggregators does not buy as much validation as it looks like. CoinGecko, CoinMarketCap, CoinPaprika and CoinLore partly share upstream data — if they agree, that is weaker evidence than four independent measurements would be.

Binance is in the default set specifically because it is an exchange, reporting its own order book rather than republishing someone else's aggregate. That is a genuinely independent signal.

It comes with a trade-off worth stating plainly: Binance quotes no direct fiat USD pairs. The connector requests <COIN><quote_asset> markets (BTCUSDT by default) and emits pairs already named <COIN>/USD, without converting anything. During a depeg every Binance rate is off by the depeg magnitude.

That is handled rather than hidden. The rates split into their own divergence group, groupPercentage decides whether it is reported, and strategy resolves the pair from the healthy group. The substitution deliberately lives inside the connector and must not be expressed as a global mappings entry — a "USDT": "USD" mapping would apply to every source and rewrite the genuine USDT/USD quote from the aggregators into a degenerate USD/USD, dropping exactly the quote that makes a depeg observable. USDT/USD and USDC/USD are in the aggregator defaults for that reason: the peg stays visible in the served data.

quote_asset is restricted at the schema level to USD-pegged assets, because the connector relabels the quote instead of converting it. quote_asset: "BTC" would serve the real ETHBTC price of ~0.03 as ETH/USD.

Upstream APIs are hostile in interesting ways

Each new connector is shaped by a specific upstream quirk we hit while building it.

CoinPaprika has no batch-by-IDs ticker endpoint. ?ids=, ?coin_ids= and ?id= are all silently ignored — the request fails open and returns the full payload instead of an error — and /v1/tickers/a,b answers 404. So coverage is assembled from one ranked bulk call plus one single-coin call per coin outside that rank window, with bulk_limit and max_individual_requests bounding the budget. Coins beyond the cap are excluded at startup with a named warning, instead of quietly burning the 20,000/month quota every cycle.

CoinPaprika symbols are not unique. ADM matches both adm-adamant-messenger (rank ~1460, a coin) and adm-voice-of-the-gods-by-virtuals (rank ~5688, a token). A first-match lookup would silently substitute one asset for another. Symbols are resolved among active candidates by best rank, and every returned ticker symbol is verified before its price is emitted.

CoinLore's numeric IDs are reassigned across listings. An ID that pointed at one asset can later point at another. A configured ID is therefore trusted only as long as the quote it returns still carries the expected symbol; a stale ID produces a missing rate and a log line rather than a wrong price.

Binance rejects a whole batch for one bad symbol. symbols=["BTCUSDT","ADMUSDT"] answers 400 — not a partial result. Without upfront validation a single misconfigured coin would take the entire source offline every cycle, so markets are resolved once at startup, and a 400 triggers per-candidate validation to pinpoint and drop the unlisted one.

ExchangeRate-API returns HTTP 200 on failure, signalling the outcome in {"result": "error"}. That field is treated as the only reliable success indicator.

History queries: 22.8 s → 8 ms

Every tickers index is now date-ordered, because every /getHistory filter sorts by date:

{ date: 1 }                       unfiltered history
{ base: 1, date: -1 }             coin=ADM/, and one branch of a bare coin=ADM
{ quote: 1, date: -1 }            coin=/USD, and the other branch
{ base: 1, quote: 1, date: -1 }   exact coin=ADM/USD

The bare-symbol form is an $or over base and quote; giving both branches a date-ordered index lets the planner merge them in sorted order instead of sorting the whole matching history before the cursor can stop.

Measured on a production collection of 238 million ticker documents, same host, same data, same query (base:BTC, quote:USD, one week, limit 100), only the index differs:

Index	Time	Keys examined	Docs examined	Blocking sort
{base, quote, date: -1}	8 ms	100	100	no
{base, quote} (old)	22 820 ms	335 880	335 880	yes

If you run a large history collection, build the new indexes out of band before deploying — Mongoose creates them on connect and it is real I/O. Measured on two production deployments with ~238M documents each: 17 minutes on NVMe, 50 minutes on SATA, with indexSize roughly doubling during the transition. The upgrade guide has the exact procedure.

A correctness bug worth calling out

On 4.1.x the historical coin pair filter was inverted. GET /getHistory?coin=ADM/USD matched USD/ADM and therefore returned nothing at all, while coin=ADM/ returned pairs with ADM as the quote.

4.2.0 uses the documented BASE/QUOTE order everywhere. If you carried a client-side reversal workaround, remove it. Bare-symbol filters (coin=ADM) were always correct and are unchanged — they match either side.

Other correctness work:

• minSources is now measured against sources that are fresh for the requested lifetime, so a stale provider can no longer satisfy the source-count gate
• triangulated cross rates are re-checked, because rounding can collapse a small rate to zero
• /get and /getHistory schemas are .strict(): an unknown query parameter is a 400 rather than something silently ignored, and validation errors return 400 instead of 500
• coin symbols from providers and query filters accept a wider Unicode-aware form, so every stored pair is addressable — $CWIF is a real example — while typos in base_coins still fail at startup
• /status reports updating from actual update state rather than inferring it from a timestamp comparison, and concurrent refresh cycles are skipped rather than overlapped

Security

Every log line and every notification now passes through a redactor that strips API keys, bearer tokens, URI credentials and sensitive query parameters — including from Axios error URLs, which is the path that most often leaks a key in a stack trace.

This was not hypothetical. Checking a production deployment during the upgrade, 9 of 71 historical 4.1.x log files contained a live API key in plaintext, every one of them arriving through exactly that path:

error| Request to https://api.exchangerate.host/live?access_key=<REDACTED> failed with 520 status code.

Zero occurrences in the 4.2.0 logs.

Alongside that: the logs directory is created 0750 and log files 0600; log file names no longer contain colons, which made them unopenable on some filesystems; the container runs as the unprivileged node user with npm, pnpm and yarn removed from the runtime image; config.jsonc is deliberately absent from the image so no layer can carry a credential; and configuration validation is strict enough to reject unknown keys, placeholder credentials and case-mismatched values before the port opens.

Trivy scans every image before publication, and multer and js-yaml are pinned through overrides so pnpm audit and pnpm audit --prod both come back clean.

Tested, and run in production

The suite grew from 3 spec files to 28 — 266 tests covering every source connector, the merger and its strategies, the sources manager, configuration loading and migration, the logger, the notifier, both request schemas, the exception filter, the validation pipe, the interceptor, the controller and the shared utilities.

Beyond CI, 4.2.0 has been rolled out to the two ADAMANT production instances that serve the Messenger clients — around 1,200 pairs each, over four years of history, ~238M ticker documents per node — upgraded one at a time with no simultaneous downtime and no regression in served rates.

Documentation

There is now a real documentation site: https://currencyinfo.docs.adamant.im. Quick start, installation, architecture, rate calculation, history, notifications, operations, security, troubleshooting and upgrading, plus a full REST and configuration reference and a page per rate source documenting quota, identifier form, failure mode and redistribution terms.

That last part matters and is easy to miss:

Keyless access is not the same as permission to republish. CoinPaprika and ExchangeRate-API both restrict redistribution by a public or commercial instance. If you are serving these rates onwards rather than consuming them yourself, read source terms and redistribution first.

---

Currencyinfo is GPL-3.0 and self-hosted: your own rates service, your own infrastructure, no third party learning which coins your users hold. ADM is one symbol among the defaults — removing it changes nothing else.

Questions, bug reports and deployment war stories are welcome in this thread. Issues go to the tracker; security reports privately to devs@adamant.im.