Security: Rate limiting missing on critical endpoints

[chonilius]

Problem

The backend API lacks rate limiting on authentication and mutation endpoints, making it vulnerable to:

• Brute force attacks on OAuth flows
• Replay attacks on idempotent mutations
• DoS attacks exhausting database/Soroban RPC resources

Vulnerable Endpoints

Based on the API overview (README.md), these endpoints lack rate limiting:

Authentication

• POST /api/auth/login - OAuth initiation
• POST /api/auth/callback - OAuth completion

High-value mutations

• POST /api/bounties/:id/fund
• POST /api/bounties/:id/claim
• POST /api/escrow/:id/release
• POST /api/escrow/:id/refund
• POST /api/milestones/:id/fund
• POST /api/maintenance-pools/:id/deposit
• POST /api/github/webhooks (external endpoint)

List endpoints (resource exhaustion)

• GET /api/bounties
• GET /api/milestones
• GET /api/analytics/*

Attack Scenarios

1. Brute Force OAuth State Parameter

An attacker could repeatedly hit the OAuth callback trying different state values to hijack sessions.

2. Idempotency Key Exhaustion

The idempotency system has a 30-second conflict window. An attacker could:

• Generate thousands of UUIDs
• Send concurrent requests with unique keys
• Exhaust database connections and Soroban RPC quota
• Cause legitimate requests to fail

3. Webhook DoS

Without rate limiting, an attacker could flood /api/github/webhooks with invalid payloads to:

• Exhaust database with WebhookEvent rows
• CPU spike from HMAC verification
• Block legitimate GitHub webhook deliveries

Recommended Solution

Implement multi-tier rate limiting with @nestjs/throttler:

// app.module.ts
import { ThrottlerModule, ThrottlerGuard } from '@nestjs/throttler';

@Module({
  imports: [
    ThrottlerModule.forRoot([
      {
        name: 'short',
        ttl: 1000,  // 1 second
        limit: 3,   // 3 requests
      },
      {
        name: 'medium',
        ttl: 60000,  // 1 minute
        limit: 20,
      },
      {
        name: 'long',
        ttl: 3600000,  // 1 hour
        limit: 100,
      },
    ]),
  ],
  providers: [
    {
      provide: APP_GUARD,
      useClass: ThrottlerGuard,
    },
  ],
})
export class AppModule {}

Per-endpoint overrides:

// Critical mutations: stricter limits
@Throttle({ short: { limit: 1, ttl: 1000 } })
@Post('bounties/:id/fund')
async fundBounty() { ... }

// Webhooks: separate limit by IP
@Throttle({ medium: { limit: 50, ttl: 60000 } })
@Post('github/webhooks')
async handleWebhook() { ... }

// Public lists: lenient but protected
@Throttle({ long: { limit: 1000, ttl: 3600000 } })
@Get('bounties')
async listBounties() { ... }

Redis-backed storage (production):

ThrottlerModule.forRoot({
  storage: new ThrottlerStorageRedisService(new Redis({
    host: process.env.REDIS_HOST,
    port: parseInt(process.env.REDIS_PORT),
  })),
})

Additional Hardening

1. IP-based blocking: Ban IPs after N failed signature verifications
2. Exponential backoff: Increase delays after repeated 429 responses
3. Webhook IP allowlist: GitHub publishes their webhook source IPs - validate against them
4. Per-user limits: Track limits by userId for authenticated endpoints, not just IP

References

• NestJS Throttler Documentation
• OWASP: Denial of Service Cheat Sheet
• GitHub Webhook IPs

Priority

🟠 High - Should be implemented before public beta

[cythecode]

@cythecode has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hello maintainer, I’ve got this covered! Ready to deliver a clean, high-impact PR—swiftly done and ready to get merged seamlessly

ℹ️ Repo Maintainers: To accept this application, review their application or assign @cythecode to this issue.

[Olayinka93]

@Olayinka93 has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hello, this issue aligns well with my skills and experience. I’m confident I can resolve it effectively and deliver a proper solution. Kindly consider assigning it to me.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Olayinka93 to this issue.

[TheFaith-Code]

@TheFaith-Code has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hi, I'd like to work on this issue.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @TheFaith-Code to this issue.

[D-Bluemoon]

@D-Bluemoon has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hey maintainer, I would love to tackle this rate-limiting implementation. Leaving those critical mutation endpoints and OAuth flows exposed without throttling is a ticking time bomb for RPC exhaustion and brute-force attacks, so I completely see why this is a priority.

I have solid experience securing NestJS backends and can quickly implement the multi-tier @nestjs/throttler architecture backed by Redis that you outlined. Beyond just the basic rate limiting, I'm really keen on setting up the extra hardening—specifically validating the GitHub webhooks against their official IP allowlist and enforcing strict per-user limits on authenticated routes (rather than just relying on IP tracking).

I'd love to get these endpoints locked down for you. Let me know if I can jump in!

ℹ️ Repo Maintainers: To accept this application, review their application or assign @D-Bluemoon to this issue.

[drips-wave]

Congratulations, @D-Bluemoon! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on August 31, 2026.

🧑‍💻 @D-Bluemoon: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊