Risk Level
HIGH
File
core/src/router/client.ts
Findings
All public search/match methods return Promise<any>
- Line 34:
async getMarketMatches(params: FetchMatchesParams): Promise<any> — typed params but untyped return
- Line 48:
async getEventMatches(params: FetchEventMatchesParams): Promise<any> — same pattern
- Line 62:
async browseMarketMatches(params: FetchMarketMatchesParams): Promise<any> — same pattern
- Line 72–73:
const pairs: any[] = ...; pairs.map((pair: any) => ...) — response array and elements untyped
- Line 84:
async browseEventMatches(params: FetchEventMatchesParams): Promise<any> — same pattern
- Line 96:
async searchMarkets(params?: RouterMarketSearchParams): Promise<any> — typed params, untyped return
- Line 108:
async searchEvents(params?: RouterEventSearchParams): Promise<any> — same pattern
- Line 120:
async getArbitrage(query?: Record<string, string>): Promise<any> — return untyped
- Line 133:
): Promise<{ data: any }> — wrapper response type carries any data
Error handling
- Line 141:
} catch (error: any) { — catch clause any instead of unknown
- Line 146:
private mapError(error: any): Error — error mapper param untyped; should be unknown
Impact
- Every caller of
getMarketMatches, getEventMatches, browseMarketMatches, browseEventMatches, searchMarkets, searchEvents, getArbitrage receives any — the router client's entire response surface is untyped
- Consumers in the SDK layer propagate these
any returns upward to end users
mapError(error: any) allows unsafe property access on caught errors without narrowing
Suggested Fix
- Define
MatchPair, MarketSearchResult, EventSearchResult, ArbitrageResult interfaces matching the router API response shapes
- Return these concrete types from the public methods (e.g.
Promise<MatchPair[]>)
- Replace
Promise<{ data: any }> with Promise<{ data: T }> using a generic helper
- Use
catch (error: unknown) and mapError(error: unknown): Error with an instanceof guard inside
Found by automated any type audit
Risk Level
HIGH
File
core/src/router/client.tsFindings
All public search/match methods return
Promise<any>async getMarketMatches(params: FetchMatchesParams): Promise<any>— typed params but untyped returnasync getEventMatches(params: FetchEventMatchesParams): Promise<any>— same patternasync browseMarketMatches(params: FetchMarketMatchesParams): Promise<any>— same patternconst pairs: any[] = ...; pairs.map((pair: any) => ...)— response array and elements untypedasync browseEventMatches(params: FetchEventMatchesParams): Promise<any>— same patternasync searchMarkets(params?: RouterMarketSearchParams): Promise<any>— typed params, untyped returnasync searchEvents(params?: RouterEventSearchParams): Promise<any>— same patternasync getArbitrage(query?: Record<string, string>): Promise<any>— return untyped): Promise<{ data: any }>— wrapper response type carriesanydataError handling
} catch (error: any) {— catch clauseanyinstead ofunknownprivate mapError(error: any): Error— error mapper param untyped; should beunknownImpact
getMarketMatches,getEventMatches,browseMarketMatches,browseEventMatches,searchMarkets,searchEvents,getArbitragereceivesany— the router client's entire response surface is untypedanyreturns upward to end usersmapError(error: any)allows unsafe property access on caught errors without narrowingSuggested Fix
MatchPair,MarketSearchResult,EventSearchResult,ArbitrageResultinterfaces matching the router API response shapesPromise<MatchPair[]>)Promise<{ data: any }>withPromise<{ data: T }>using a generic helpercatch (error: unknown)andmapError(error: unknown): Errorwith aninstanceofguard insideFound by automated any type audit