You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Here are some key observations to aid the review process:
⏱️ Estimated effort to review: 3 🔵🔵🔵⚪⚪
🧪 No relevant tests
🔒 Security concerns
Sensitive information exposure: loadMarketsWithRetry logs e?.message from ccxt errors; depending on the exchange/client, error messages can sometimes include request details. Consider sanitizing/whitelisting logged error fields. Also, enabling TypeORM synchronize: true can cause unintended schema changes in production environments, which is a deployment safety concern.
The ORM setting synchronize was switched to enabled, which can unintentionally mutate/drop schema in non-development environments and makes DB changes implicit rather than controlled via migrations. This should be guarded by environment (e.g., only in local/test) and/or replaced with migrations in deployed environments.
The startPrice column was removed from StrategyInstance while multiple strategy creation flows now have startPrice logic commented out. Verify no runtime paths, analytics, reporting, or UI rely on startPrice, and ensure the DB migration/cleanup and any backward compatibility concerns are handled.
loadMarketsWithRetry adds retries and logging, but it may still behave poorly under rate limiting / transient network failures (fixed backoff, no jitter, no timeout/cancel, and it retries all errors). Consider narrowing retryable errors (e.g., network/timeout/429), adding jitter, and ensuring logging won’t leak sensitive request details if ccxt error messages contain them.
Enabling automatic schema synchronization can unintentionally alter or drop tables in non-dev environments. Gate synchronize behind an explicit env flag (or restrict it to non-production) so production DBs aren’t modified by application startup.
Why: Setting TypeORM synchronize: true can be destructive in non-dev environments (implicit schema changes/drops on startup). Gating synchronize behind an explicit env flag (and/or disabling in production) is a high-impact safety improvement.
Medium
Ensure pricing exchange name fallback
Passing oracleExchangeName directly can be undefined when no oracle is provided, causing pricing to fail or select the wrong exchange. Compute a fallback to executionExchangeName (or a known default) before calling getPriceSource.
Why: The new code passes oracleExchangeName directly into getPriceSource, which can be undefined when no oracle is provided, potentially breaking price fetching. Adding a fallback to executionExchangeName preserves the previous behavior where a pricing exchange was always selected.
Medium
General
Reduce exchange rate-limit hammering
Retrying loadMarkets without considering rateLimit can hammer the exchange and trigger bans/429s during outages. Short-circuit if markets are already loaded, and base backoff on exchange.rateLimit to reduce the chance of repeated throttling.
Why: Using exchange.rateLimit for backoff and skipping retries when exchange.markets is already populated can reduce unnecessary load and mitigate 429/bans during outages. This is a reasonable resiliency tweak, though the current fixed backoff is already functional.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
fix issues with the testnet not working