Issues

• cache_capabilities stores arbitrary u32 capability codes without validation

  bugpriority: lowrust
  Haroldwonder/AnchorKit#1432 · Filter by author Haroldwonder opened on Oct 14, 2026

• route_transaction can select quotes from revoked attestors or anchors that no longer offer quotes

  bugpriority: highrustsecurity
  Haroldwonder/AnchorKit#1431 · Filter by author Haroldwonder opened on Oct 14, 2026

• replay_window_seconds and clock_skew_seconds are unbounded and can't be changed after initialize

  priority: mediumrustsecurity
  Haroldwonder/AnchorKit#1430 · Filter by author Haroldwonder opened on Oct 14, 2026

• set_max_page_size has no upper bound

  bugpriority: lowrust
  Haroldwonder/AnchorKit#1429 · Filter by author Haroldwonder opened on Oct 14, 2026

• Sessions can't be closed explicitly before they expire

  enhancementpriority: lowrust
  Haroldwonder/AnchorKit#1428 · Filter by author Haroldwonder opened on Oct 14, 2026

• Session lifetime is hardcoded to 24h; the sessions.session_timeout_seconds config setting is ignored

  enhancementpriority: lowrust
  Haroldwonder/AnchorKit#1427 · Filter by author Haroldwonder opened on Oct 14, 2026

• submit_attestation_batch has no maximum batch size

  bugpriority: mediumrustsecurity
  Haroldwonder/AnchorKit#1426 · Filter by author Haroldwonder opened on Oct 14, 2026

• revoke_attestor leaves the attestor's endpoint, services, and keys in place, and re-registration inherits them

  bugpriority: mediumrust
  Haroldwonder/AnchorKit#1425 · Filter by author Haroldwonder opened on Oct 14, 2026

• migrate() can overwrite the TOTALCNT counter key and brick attestation submission

  bugpriority: highrustsecurity
  Haroldwonder/AnchorKit#1424 · Filter by author Haroldwonder opened on Oct 14, 2026

• get_attestation and get_attestation_or_panic extend the TTL of revoked and expired attestations

  performancepriority: lowrust
  Haroldwonder/AnchorKit#1423 · Filter by author Haroldwonder opened on Oct 14, 2026

• No rust-toolchain.toml: CI and contributors build with whatever 'stable' happens to be

  cipriority: lowtooling
  Haroldwonder/AnchorKit#1422 · Filter by author Haroldwonder opened on Oct 14, 2026

• CI never checks Rust formatting (cargo fmt --check)

  cigood first issuepriority: lowtooling
  Haroldwonder/AnchorKit#1421 · Filter by author Haroldwonder opened on Oct 14, 2026

• Cargo.lock is gitignored, so CI cache keys are constant and binary/WASM builds aren't reproducible

  cidependenciespriority: mediumtooling
  Haroldwonder/AnchorKit#1420 · Filter by author Haroldwonder opened on Oct 14, 2026

• .gitignore ignores test_snapshots/ even though 269 snapshot files are tracked and the tests depend on them

  bugpriority: mediumtestingtooling
  Haroldwonder/AnchorKit#1419 · Filter by author Haroldwonder opened on Oct 14, 2026

• TransactionStateTracker cache grows without bound and every lookup is a linear scan

  performancepriority: lowrust
  Haroldwonder/AnchorKit#1418 · Filter by author Haroldwonder opened on Oct 14, 2026

• TransactionStateTracker is documented as an off-chain SDK utility but is private and unreachable

  bugpriority: mediumrust
  Haroldwonder/AnchorKit#1417 · Filter by author Haroldwonder opened on Oct 14, 2026

• SdkConfig's Network enum has no Futurenet variant even though the CLI and configs support futurenet

  enhancementpriority: lowrust
  Haroldwonder/AnchorKit#1416 · Filter by author Haroldwonder opened on Oct 14, 2026

• validate_deposit_response requires deposit_address and expires_at, which SEP-6 doesn't mandate

  bugpriority: mediumrust
  Haroldwonder/AnchorKit#1415 · Filter by author Haroldwonder opened on Oct 14, 2026

• validate_quote_response accepts a fee larger than the quoted amount

  bugpriority: lowrust
  Haroldwonder/AnchorKit#1414 · Filter by author Haroldwonder opened on Oct 14, 2026

• get_fee_estimate ignores its FeeOperation argument

  bugpriority: lowrust
  Haroldwonder/AnchorKit#1413 · Filter by author Haroldwonder opened on Oct 14, 2026

• get_transactions applies the status filter after the page limit, returning short pages

  bugpriority: lowrust
  Haroldwonder/AnchorKit#1412 · Filter by author Haroldwonder opened on Oct 14, 2026

• initiate_withdrawal doesn't validate the anchor-provided account_id as a Stellar address

  bugpriority: mediumrustsecurity
  Haroldwonder/AnchorKit#1411 · Filter by author Haroldwonder opened on Oct 14, 2026

• deposit_exchange / withdraw_exchange accept identical source and destination assets

  bugpriority: lowrust
  Haroldwonder/AnchorKit#1410 · Filter by author Haroldwonder opened on Oct 14, 2026

• get_transaction_status maps HTTP 5xx to non-retryable ValidationError

  bugpriority: mediumrust
  Haroldwonder/AnchorKit#1409 · Filter by author Haroldwonder opened on Oct 14, 2026

• SEP-6 helpers reject valid lowercase Stellar asset codes

  bugpriority: mediumrust
  Haroldwonder/AnchorKit#1408 · Filter by author Haroldwonder opened on Oct 14, 2026