Exploit for aurora-earn-poc

## https://sploitus.com/exploit?id=C32FE733-1F33-533C-AAA2-8B4C312523F2
# Aurora Earn PoC

A TypeScript HTTP service that reads Kraken Earn strategy and asset metadata from local JSON files, filters and formats them into a consumer-facing product list, and exposes a single `GET /earn-products` endpoint. Built with Fastify on Node 20, strict TypeScript, and a clean `data → domain → server` pipeline. No business logic runs at startup beyond loading and validating the JSON fixtures.

## Run

```bash
docker compose up
```

The service listens on `http://localhost:3000`.

### Example Requests

```bash
# Health check
curl http://localhost:3000/health
# → {"status":"ok"}

# Earn products for Standard tier
curl "http://localhost:3000/earn-products?tier=standard"
# → [
#     {
#       "strategyId": "ESRFUO3-Q62XD-WIOIL7",
#       "asset": "DOT",
#       "displayName": "DOT Flexible Staking",
#       "lockType": "instant",
#       "apyDisplay": "12.00%",
#       "apyValue": 12,
#       "eligibleTiers": ["Standard", "Premium", "Private"],
#       "minimumAmount": "0.01"
#     },
#     ...
#   ]

# Invalid tier
curl "http://localhost:3000/earn-products?tier=bogus"
# → {"error":{"code":"INVALID_TIER","message":"..."}}
```

### Other Commands

| Command | Description |
|---|---|
| `npm run dev` | Hot-reload dev server via tsx watch |
| `npm run build` | Compile TypeScript to `dist/` |
| `npm start` | Run compiled output from `dist/` |
| `npm test` | Run all tests (Node built-in test runner) |

## Key Dependencies

| Package | Version | Role | Safety Notes |
|---|---|---|---|
| `fastify` | 4.29.1 | HTTP server | Actively maintained (weekly releases). Chosen over Express for built-in JSON schema validation, plugin ecosystem, and structured error handling. **Note:** Fastify 4.x has a transitive CVE in `fast-uri` (path traversal / host confusion via percent-encoded segments, GHSA-q3j6-qgpj-74h6 / GHSA-v39h-62p7-jpjc). The PoC does not accept user-controlled URIs in any route, so the attack surface is nil for this use case. Upgrading to Fastify 5.x resolves it and is the recommended next step before production. |
| `typescript` | 5.9.3 | Type checking / build | Dev-only. Microsoft-maintained, stable. No known CVEs. |
| `tsx` | 4.23.1 | Dev runner (replaces ts-node) | Dev-only. Used for `dev` and `test` scripts. Not in the production Docker image. |
| `@types/node` | 20.19.43 | Node type definitions | Dev-only. Matches the Node 20 runtime. |

## Known Limitations / What I'd Improve

- **APR ≈ APY simplification.** The service uses `apr_estimate.high` as the displayed "APY." APR and APY are not the same (APY accounts for compounding frequency). A production system should compute true APY from the APR band, payout frequency, and auto-compound settings.
- **No caching.** Data is loaded once at startup from local JSON. There is no in-process cache, no TTL, and no background refresh. A restart is required to pick up data changes.
- **No authentication.** The `tier` query parameter is trusted as-is. There is no API key, JWT, or session validation. Production should authenticate the caller and derive tier server-side.
- **No pagination.** The endpoint returns all matching products in a single response. The Kraken API supports `cursor`/`limit` paging; this PoC does not.
- **No live Kraken integration.** The service reads mock JSON files, not the live Kraken REST API. No HMAC-SHA512 signing, no rate-limit handling, no retry/backoff.
- **No observability.** Structured logs go to stdout (Pino) but there are no metrics, traces, or health probes beyond `GET /health`.
- **Geo-restriction not modeled.** The live Kraken `Strategies` endpoint filters by the caller's region. The mock data does not reflect this, so all strategies are visible regardless of geography.

## Project Structure

```
aurora-earn-poc/
├── data/
│   ├── assets.json              # Kraken AssetInfo mock (altname, decimals, status)
│   └── strategies.json          # Kraken Earn Strategies mock (14 strategies)
├── docs/
│   └── Kraken_List_Earn_Strategies_API_Docs.md
├── src/
│   ├── data/
│   │   ├── loader.ts            # Reads & validates JSON files → LoaderResult
│   │   └── loader.test.ts
│   ├── domain/
│   │   ├── filter.ts            # Tier eligibility, APY extraction, strategy filtering
│   │   ├── filter.test.ts
│   │   ├── format.ts            # Maps raw strategy → AuroraProduct, sorts by APY desc
│   │   └── format.test.ts
│   ├── server/
│   │   ├── app.ts               # Fastify app factory (routes, schema, error handler)
│   │   ├── index.ts             # Entry point: load data, build server, listen
│   │   └── index.test.ts
│   └── types/
│       └── kraken.ts            # TypeScript types mirroring Kraken API response shapes
├── Dockerfile                   # Multi-stage: builder (tsc) → runtime (node:20-alpine)
├── docker-compose.yml
├── package.json
├── tsconfig.json
├── .gitignore
└── .dockerignore