MergeFi/backend
Is MergeFi/backend beginner-friendly?
In the last 30 days, MergeFi/backend merged 20 of 106 pull requests from outside contributors, and its maintainers usually reply within 1 day. No beginner-friendly issue is open right now; the list below has the other issues we hold for it.
- Stars
- 2
- Forks
- 90
- Open beginner issues
- 0
- Indexed issues
- 128
- Avg merge
- 31m
- Merged PRs (30d)
- 20
- Dominant language
- TypeScript
- License
- No license data
- Last GitHub push
- Oct 15, 2026
- Latest indexed
- Oct 15, 2026
- Contributing guide
- No contributing guide
- Code of conduct
- No code of conduct
- Beginner labels
- good first issue help wanted
How to contribute to MergeFi/backend
- There is no contributing guide, so start from the README and a few recently merged pull requests to see how changes are proposed.
- It ships a Dockerfile or Docker Compose file, so you can run it without installing its whole toolchain.
- Follow the repository to hear when a new beginner-friendly issue opens, or look through the other issues below.
Issues somebody may already be working on are listed last. List everything by date
-
EscrowService.refund()/release() check the caller's role but never bind the check to the specific escrow's sponsor — any SPONSOR can force-refund any other sponsor's escrowMay be free again @Ranjeet2063 claimed this 52 days ago, and no pull request is open. Open
Difficulty 3/5 1-2 days Newbie friendliness 42/100
MergeFi/backend#299 · 2 comments ·
Maintainers usually reply within 1 day
-
The access_token cookie is set without the `secure` flag outside NODE_ENV=production, including on HTTPS staging deploysPossibly taken @urielit1313-creator claimed this 29 days ago. Opengood first issue security
Difficulty 2/5 1-3 hours Newbie friendliness 20/100
MergeFi/backend#614 · 1 comment ·
Maintainers usually reply within 1 day
-
POST /milestones/:id/allocate and /bounties/:id/approve|reject are documented in Swagger as working operationsPossibly taken @urielit1313-creator claimed this 29 days ago. Opendocumentation good first issue
Difficulty 2/5 Under an hour Newbie friendliness 25/100
MergeFi/backend#613 · 2 comments ·
Maintainers usually reply within 1 day
-
test/users.e2e-spec.ts expects 403 for an unauthenticated request, but JwtAuthGuard returns 401Possibly taken @urielit1313-creator claimed this 29 days ago. Opengood first issue testing
Difficulty 2/5 1-3 hours Newbie friendliness 22/100
MergeFi/backend#612 · 1 comment ·
Maintainers usually reply within 1 day
-
STELLAR_NETWORK and STELLAR_NETWORK_PASSPHRASE are never cross-checkedPossibly taken @urielit1313-creator claimed this 29 days ago. Openbug security
Difficulty 3/5 Half a day Newbie friendliness 18/100
Maintainers usually reply within 1 day
-
ESCROW_DEADLINE_SECONDS and PORT are parsed without validation — a typo makes every fund throw RangeErrorPossibly taken @urielit1313-creator claimed this 29 days ago. Openbug good first issue
Difficulty 2/5 1-3 hours Newbie friendliness 25/100
Maintainers usually reply within 1 day
-
deriveOnChainId hashes UUIDs into u64 keys with no collision check, and milestone/pool keys share the escrow contract's issue_id spacePossibly taken @urielit1313-creator claimed this 29 days ago. Openbug security
Difficulty 4/5 3-5 days Newbie friendliness 15/100
Maintainers usually reply within 1 day
-
MaintenancePoolService.assignReward reports a stale balance in its 'exceeds pool balance' errorPossibly taken @urielit1313-creator claimed this 29 days ago. Openbug good first issue
Difficulty 2/5 1-3 hours Newbie friendliness 22/100
Maintainers usually reply within 1 day
-
Controller specs pass unbound methods to expect() (unbound-method lint errors)Possibly taken @DeFex-lab claimed this 23 days ago. Opengood first issue Stellar Wave testing
Difficulty 2/5 1-3 hours Newbie friendliness 30/100
MergeFi/backend#606 · 3 comments · 1 assignee ·
Maintainers usually reply within 1 day
-
Unused variables on main hide logic that was lost in merges (previousStatus, existingPool, callerUserId…)Possibly taken @urielit1313-creator claimed this 29 days ago. Openbug good first issue
Difficulty 3/5 1-2 days Newbie friendliness 25/100
Maintainers usually reply within 1 day
-
common/validators/date.validator.ts has no spec filePossibly taken @DeFex-lab claimed this 23 days ago. Opengood first issue Stellar Wave testing
Difficulty 2/5 1-3 hours Newbie friendliness 25/100
MergeFi/backend#604 · 3 comments · 1 assignee ·
Maintainers usually reply within 1 day
-
BountiesService.expireOverdue() overwrites concurrently-advanced bounties to EXPIRED — read-then-save with no status re-check and no assertTransitionPossibly taken @Youngthreader claimed this 22 days ago. Openarchitecture bug Stellar Wave very hard
MergeFi/backend#460 · 4 comments · 1 assignee ·
Maintainers usually reply within 1 day
-
assignReward decrements MaintenancePool.balance before poolWithdraw() and never restores it when the withdrawal failsPossibly taken @Fabulouz34 claimed this 43 days ago. Openarchitecture bug Stellar Wave very hard
MergeFi/backend#459 · 5 comments · 1 assignee ·
Maintainers usually reply within 1 day
-
[Regression on closed #273] assignReward's double-payout guard is keyed on (pool, recipient) instead of (pool, issue) — the same issue can still be paid twicePossibly taken @MrOmale claimed this 22 days ago. Openbug security Stellar Wave very hard
MergeFi/backend#458 · 5 comments · 1 assignee ·
Maintainers usually reply within 1 day
-
MaintenancePoolService.deposit() always throws PessimisticLockTransactionRequiredError — the #275 SELECT ... FOR UPDATE runs outside any transactionPossibly taken @Emmzydice1 claimed this 43 days ago. Openarchitecture bug Stellar Wave very hard
MergeFi/backend#457 · 5 comments · 1 assignee ·
Maintainers usually reply within 1 day
-
releasePartial() sends the wrong on-chain key to the contract — a raw UUID instead of the numeric onChainId every other operation usesPossibly taken @PINYOPATTANAWASANPORN claimed this 29 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 35/100
MergeFi/backend#300 · 5 comments ·
Maintainers usually reply within 1 day
-
Bounty/Milestone/MaintenancePool/User list endpoints have no pagination and return the entire table in one unbounded responsePossibly taken @senmalong claimed this 87 days ago. OpenGrantFox OSS Maybe Rewarded Official Campaign | FWC26 performance Third Campaign very hard
MergeFi/backend#63 · 3 comments · 1 assignee ·
Maintainers usually reply within 1 day
-
TeamMemberSplit.user uses onDelete: CASCADE, so deleting any team member's account silently desyncs a team's split percentages from 100 and can permanently strand that team's bountyPossibly taken @gramseostudio-dev claimed this 86 days ago. Openarchitecture bug GrantFox OSS Maybe Rewarded Official Campaign | FWC26 Third Campaign very hard
MergeFi/backend#58 · 2 comments · 1 assignee ·
Maintainers usually reply within 1 day
-
Because no money-moving route requires auth, IdempotencyInterceptor buckets every caller under a shared 'anonymous' identity per scope, letting unrelated callers collide on each other's cached responsesPossibly taken @gramseostudio-dev claimed this 87 days ago. Openbug GrantFox OSS Maybe Rewarded Official Campaign | FWC26 security Third Campaign very hard
MergeFi/backend#55 · 2 comments · 1 assignee ·
Maintainers usually reply within 1 day
-
release() and splitRelease() never check for pre-existing Payment rows, so calling them after releasePartial causes a double payout of the full escrow amountPossibly taken @Kappa16 claimed this 83 days ago. Openbug GrantFox OSS Maybe Rewarded Official Campaign | FWC26 security Third Campaign very hard
MergeFi/backend#44 · 3 comments · 1 assignee ·
Maintainers usually reply within 1 day
-
Money-moving DTOs trust client-supplied contributorId/recipientId/funderAddress instead of binding to the authenticated callerPossibly taken @davieslennox0 claimed this 86 days ago. Openarchitecture GrantFox OSS Maybe Rewarded Official Campaign | FWC26 security Third Campaign very hard
MergeFi/backend#40 · 2 comments · 1 assignee ·
Maintainers usually reply within 1 day
-
UsersController.setStellarAddress is authenticated but not authorized: any logged-in user can overwrite another user's payout addressPossibly taken @rudra496 claimed this 86 days ago. Openbug GrantFox OSS Maybe Rewarded Official Campaign | FWC26 security Third Campaign very hard
MergeFi/backend#39 · 2 comments · 1 assignee ·
Maintainers usually reply within 1 day
-
Docker/deployment tooling is entirely absent: no Dockerfile, no docker-compose for local Postgres, no CI pipeline definitionPossibly taken @JuanVP2 claimed this 118 days ago. Opendocumentation enhancement GrantFox OSS help wanted Maybe Rewarded Official Campaign | FWC26 very hard
MergeFi/backend#30 · 3 comments · 1 assignee ·
Maintainers usually reply within 1 day