MoltyDEX Logo - x402 Token Aggregator for AI AgentsMoltyDEX

Changelog

Full history of MoltyDEX production updates, security fixes, and platform improvements.

February 12, 2026

Latest

Deep Audit: 30+ Fixes Across Security, SDK, and Swap Flow

Comprehensive line-by-line audit of the entire platform. Found 96 issues across 4 severity levels (15 critical, 25 high, 30 medium, 26 low). All critical and high issues resolved.

Security Hardening

  • ✓Enabled Helmet with tightened Content Security Policy
  • ✓Restricted CORS from wildcard to explicit allowed origins
  • ✓Fixed trust proxy configuration for accurate rate limiting
  • ✓Moved Alchemy RPC key from frontend env to server-side proxy (new /api/rpc route)
  • ✓Eliminated dangerouslySetInnerHTML XSS vector in Google Analytics
  • ✓Secured analytics debug endpoint and track endpoint with API key auth
  • ✓Added SSRF protection on webhook callback URLs
  • ✓Added request body size limits and global error handler
  • ✓Fixed critical HTTPInterceptor payment_proof reference-before-assignment bug
  • ✓Added maxPaymentAmount safety guard to prevent runaway agent payments
  • ✓Added BigInt truncation safety check for SOL transfers over 100 SOL
  • ✓Fixed validation middleware to block requests when schema is missing

Agent Reliability

  • ✓Implemented exponential backoff retry logic in TypeScript MoltyDEXClient
  • ✓Added VersionedTransaction support to Python SDK (solders integration)
  • ✓Removed duplicate retry logic from HTTPInterceptor
  • ✓Standardized error response format (error_code field) across all API endpoints
  • ✓Removed fabricated aggregate ratings from structured data (Google penalty risk)
  • ✓Fixed fee configuration inconsistency (0.1% in metadata vs 0% in code)

Frontend Security & Stability

  • ✓Created React ErrorBoundary component for graceful UI error handling
  • ✓Sanitized Google Analytics script injection using next/script
  • ✓Standardized all canonical URLs to non-www
  • ✓Added custom branded 404 and 500 error pages

Infrastructure & Developer Experience

  • ✓Removed legacy inline route from API index.js
  • ✓Eliminated setInterval timers incompatible with serverless (Vercel)
  • ✓Added transaction size validation (1232 byte Solana limit) on swap endpoint
  • ✓Extended TypeScript MoltyDEXClient with 14 new API methods
  • ✓Implemented getConnection() singleton factory for RPC connection reuse
  • ✓Added .nvmrc, MIT LICENSE, and comprehensive .env.example files
  • ✓Updated sitemap with missing x402-payments page
  • ✓Removed unused npm dependencies (@sentry/node, winston, @jup-ag/api)

Production Polish

  • ✓Stripped debug console.log from balance.js (was leaking wallet addresses)
  • ✓Replaced 21 frontend console.log calls with production-silent debugLog helper
  • ✓Fixed poll_transaction_status to surface timeout errors instead of swallowing them
  • ✓Wired up maxRetries/retryDelay config into MoltyDEXClient (was declared but unused)

Critical Bug Fixes

  • ⚠Fixed Python SDK VersionedTransaction signing: solders has no .sign() method — now uses constructor-based signing with SoldersKeypair
  • ⚠Fixed Keypair type mismatch: VersionedTransaction needs solders.keypair.Keypair, not solana.keypair.Keypair
  • ⚠Fixed send_transaction for versioned tx: now uses send_raw_transaction(bytes())
  • ⚠Fixed wallet_path tilde expansion: os.path.expanduser() resolves ~/.config/solana/id.json
  • ⚠Added solders>=0.18.0 as explicit dependency in pyproject.toml
  • ⚠Fixed quotePath variable scope bug in jupiter.js: was crashing every Jupiter error handler
  • ⚠Fixed BigInt slippage calculation: minimum_output was always 0 due to integer division truncation
  • ⚠Fixed exchange rate display: was double-dividing by token decimals

Verification: TypeScript compiles clean (agent + frontend), all 63 agent tests pass, API syntax checks pass, zero lint errors.

February 6, 2026

Production Hardening Sprint: 5 Major Upgrades

Initial production hardening sprint focused on reliability, persistence, validation, and testing.

1. Dedicated RPC Configuration

Removed all fallbacks to public Solana RPC. The API, frontend, Python SDK, and x402 agent now all route through dedicated Alchemy/Helius endpoints. Public RPC rate-limits were silently degrading swap reliability in production.

2. Python SDK Mainnet Fix

The Python SDK was defaulting to devnet instead of mainnet. Any agent importing moltydex and not explicitly setting an RPC URL was hitting devnet. Corrected across both agentdex.py and moltydex/client.py.

3. Persistent Swap Tracking with Upstash Redis

Swap history, points, and leaderboard data were previously stored in-memory (lost on every serverless cold start). Rewrote swapTracker.js to use Upstash Redis with atomic pipelines. New analytics endpoints: /swaps/:wallet, /points/:wallet, /leaderboard, /swap-stats. Graceful fallback to in-memory if Redis is not configured.

4. Input Validation with Joi

Added Joi schema validation middleware across all API endpoints. Validates wallet addresses (base58), token mints, amounts, slippage bounds, and request body shapes. Rejects malformed requests before they reach business logic.

5. TypeScript Agent Test Suite

Built a comprehensive Vitest test suite for the x402 auto-pay agent: 63 tests covering WalletManager, MoltyDEXClient, HTTPInterceptor, and X402AutoPayAgent. Includes mocking for Solana web3.js, axios, and the fetch API. All tests passing.

← Back to MoltyDEX