Issues

SDK does not provide metrics/observability hooks for production monitoring — blind to runtime behavior

Sorokit/core#845 · opened

on Oct 18, 2026

`PriceOracle` integration does not handle stale price feeds — uses outdated prices for fee estimation

Sorokit/core#844 · opened

on Oct 18, 2026

`buildSorobanInvocation` does not validate that all required contract parameters are provided — missing params are silently ignored

Sorokit/core#843 · opened

on Oct 18, 2026

`NotificationChannel` listeners are not weak references — event listeners prevent garbage collection of subscribers

Sorokit/core#842 · opened

on Oct 18, 2026

`OfferManager` does not validate that buying and selling assets are different — allows nonsensical offers

Sorokit/core#841 · opened

on Oct 18, 2026

`ContractInvocationCache` does not handle Soroban contract upgrades — returns stale contract state after upgrade

Sorokit/core#840 · opened

on Oct 18, 2026

`BatchTransactionResult` does not include timing metadata — cannot measure per-transaction latency or order

Sorokit/core#839 · opened

on Oct 18, 2026

`validateXDR` does not check for malicious or oversized XDR envelopes — accepts invalid XDR silently

Sorokit/core#838 · opened

on Oct 18, 2026

`IssuerDiscovery` caches incorrect asset issuers from stale or compromised RPC responses — no cache invalidation on error

Sorokit/core#837 · opened

on Oct 18, 2026

`AccountSequenceTracker` does not invalidate sequence on failed submissions — stale sequence is reused

Sorokit/core#836 · opened

on Oct 18, 2026

`OperationSequencer` does not handle out-of-order operation results — final state is incorrect when operations return out of order

Sorokit/core#835 · opened

on Oct 18, 2026

`TrustlineManager` does not check if trustline already exists — allows redundant trustline setup operations

Sorokit/core#834 · opened

on Oct 18, 2026

`StreamEventEmitter` does not enforce backpressure — consumers can be overwhelmed by rapid events

Sorokit/core#833 · opened

on Oct 18, 2026

`ContractDataKey` serialization does not preserve field order — two identical keys may serialize differently

Sorokit/core#832 · opened

on Oct 18, 2026

`PathPaymentBuilder` does not validate that source and destination are different — allows self-payments

Sorokit/core#831 · opened

on Oct 18, 2026

`AccountWatcher` does not handle account deletion — observers are notified infinitely of "account not found"

Sorokit/core#830 · opened

on Oct 18, 2026

`WalletConnection` state machine does not handle rapid connect/disconnect cycles — orphaned resources leak

Sorokit/core#829 · opened

on Oct 18, 2026

`buildTransaction` does not warn when memoization is used with mutable operations — state changes may be lost

Sorokit/core#828 · opened

on Oct 18, 2026

Concurrent submissions with different fees produce inconsistent `submittedHashes` state — fee bumps are not tracked

Sorokit/core#827 · opened

on Oct 18, 2026

`SorokitResult` discriminated union does not guarantee exhaustive case handling — switch statements miss error states

Sorokit/core#826 · opened

on Oct 18, 2026

README does not include minimal working examples for common tasks — new users are lost

Sorokit/core#798 · opened

on Oct 15, 2026

TypeScript configuration does not enforce strict mode — type safety gaps are not caught

Sorokit/core#797 · opened

on Oct 15, 2026

Dependency on the Stellar SDK is not pinned — major version bumps may break sorokit-core

Sorokit/core#796 · opened

on Oct 15, 2026

`package.json` exports field does not match actual source structure — tree-shaking is broken

Sorokit/core#795 · opened

on Oct 15, 2026

Error handling across the SDK is inconsistent — some functions throw, others return `SorokitResult`

Sorokit/core#794 · opened

on Oct 15, 2026

Navigation Menu

Repository navigation

Issues

SDK does not provide metrics/observability hooks for production monitoring — blind to runtime behavior

`PriceOracle` integration does not handle stale price feeds — uses outdated prices for fee estimation

`buildSorobanInvocation` does not validate that all required contract parameters are provided — missing params are silently ignored

`NotificationChannel` listeners are not weak references — event listeners prevent garbage collection of subscribers

`OfferManager` does not validate that buying and selling assets are different — allows nonsensical offers

`ContractInvocationCache` does not handle Soroban contract upgrades — returns stale contract state after upgrade

`BatchTransactionResult` does not include timing metadata — cannot measure per-transaction latency or order

`validateXDR` does not check for malicious or oversized XDR envelopes — accepts invalid XDR silently

`IssuerDiscovery` caches incorrect asset issuers from stale or compromised RPC responses — no cache invalidation on error

`AccountSequenceTracker` does not invalidate sequence on failed submissions — stale sequence is reused

`OperationSequencer` does not handle out-of-order operation results — final state is incorrect when operations return out of order

`TrustlineManager` does not check if trustline already exists — allows redundant trustline setup operations

`StreamEventEmitter` does not enforce backpressure — consumers can be overwhelmed by rapid events

`ContractDataKey` serialization does not preserve field order — two identical keys may serialize differently

`PathPaymentBuilder` does not validate that source and destination are different — allows self-payments

`AccountWatcher` does not handle account deletion — observers are notified infinitely of "account not found"

`WalletConnection` state machine does not handle rapid connect/disconnect cycles — orphaned resources leak

`buildTransaction` does not warn when memoization is used with mutable operations — state changes may be lost

Concurrent submissions with different fees produce inconsistent `submittedHashes` state — fee bumps are not tracked

`SorokitResult` discriminated union does not guarantee exhaustive case handling — switch statements miss error states

README does not include minimal working examples for common tasks — new users are lost

TypeScript configuration does not enforce strict mode — type safety gaps are not caught

Dependency on the Stellar SDK is not pinned — major version bumps may break sorokit-core

`package.json` exports field does not match actual source structure — tree-shaking is broken

Error handling across the SDK is inconsistent — some functions throw, others return `SorokitResult`