Repository navigation
[Backend] createStreamSchema Zod validator is still unused; depositedAmount has no MAX_I128 cap #1532
Description
Labels: backend, bug, security, validation, third-wave-audit
File/location: backend/src/validators/stream.validator.ts:36 (createStreamSchema), backend/src/routes/v1/stream.routes.ts:40, backend/src/controllers/stream.controller.ts:102-230 (createStream)
Description:
createStreamSchema (with its MAX_I128 bound on ratePerSecond) is defined and unit-tested in isolation but is never imported by any route or controller — router.post('/', requireAuth, streamCreationRateLimiter, createStream) calls the manual ad-hoc BigInt parsing in createStream instead of createStreamSchema.safeParse. That manual path validates ratePerSecond/depositedAmount are positive integers but never caps depositedAmount against MAX_I128 (170141183460469231731687303715884105727), so an oversized depositedAmount string can pass validation and reach BigInt arithmetic / persisted i128 DB columns unchecked.
Acceptance Criteria:
- POST /v1/streams rejects a depositedAmount value greater than i128::MAX with a 400 error
- createStream either uses createStreamSchema.safeParse or the manual validation path gains an equivalent MAX_I128 check for depositedAmount
- A regression test posts a depositedAmount > i128::MAX and asserts a 400 response
Notes:
Two prior issues (#452 'Wire createStreamSchema validation into POST /v1/streams' and #1273 'A stricter validation schema exists but is never used') were filed and closed for this exact defect class, but the current code on main still shows the schema unused and the depositedAmount bound missing — worth checking whether the fix regressed or was never actually merged into this code path.
Activity
Ranjeet2063 commentedon Oct 4, 2026
Hi maintainers,
I reviewed this issue and would like to contribute the fix.
Solution overview:
I can deliver a clean, tested PR within 24 hours. Please assign!
ejiromowarin commentedon Oct 18, 2026
@ejiromowarin has applied to work on this issue as part of the Stellar Wave Program's 10th wave.
ℹ️ Repo Maintainers: To accept this application, review their application or assign @ejiromowarin to this issue.
OmniZlatoon commentedon Oct 18, 2026
@OmniZlatoon has applied to work on this issue as part of the Stellar Wave Program's 10th wave.
ℹ️ Repo Maintainers: To accept this application, review their application or assign @OmniZlatoon to this issue.
fadesany commentedon Oct 18, 2026
@fadesany has applied to work on this issue as part of the Stellar Wave Program's 10th wave.
ℹ️ Repo Maintainers: To accept this application, review their application or assign @fadesany to this issue.
drips-wave commentedon Oct 18, 2026
Congratulations, @fadesany! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on October 22, 2026.
🧑💻 @fadesany: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.
Warning
When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.
🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.
🌊 Happy Wave 🌊
Merge pull request #1630 from fadesany/fix/audit-1532-1533-1534-1547
grantfox-oss commentedon Oct 18, 2026
🎉 This issue has been marked as completed on GrantFox!
@fadesany's PR #1630 was approved and merged by @K1NGD4VID.
🏆 @fadesany: You earned 40 FoxPoints for this contribution! Your current tier: Builder (1,225 total points). Track your full progress on GrantFox.
👏 Great work, @fadesany! Keep contributing to LabsCrypt.
drips-wave commentedon Oct 18, 2026
This issue has been completed by @fadesany as part of the Stellar Wave Program's 10th Wave 🥳
😎 @fadesany: You earned 200 Points for completing this issue! Once the Wave's rewards are finalized, you'll be eligible for a percentage of the Wave's reward pool based on the percentage of total points you've earned. Learn more here. You can also Leave a review to share your experience working on this issue.
🧑💻 Repo maintainers: How'd the contributor do? Leave a review to share your experience working with them.
fix(backend): reject depositedAmount above i128::MAX on stream creation