Audit & tests

Last updated

Audit & tests

1,728 of 1,728 tests passed, 0 failed, in 79 files · npm run test:unit on 55462da8, 2026-10-09

Evidence links open our code on GitHub, which is private to the team.

New link previews for app pages
Shipped
Links to app.tokns.fi show redrawn preview cards, and a proposal link shows its live vote.
  • Cards follow the tokns.fi landing style, with the coral app icons.
  • Checked by eye; no automated test covers how each platform shows them.
Staking always leaves TX for fees
Verified
MAX on the Stake page and in the stake window keeps at least 3 TX back, so you can still pay to claim or unstake.
  • The stake window shows only the selected wallet's balance, not the total of every saved wallet.
  • MAX fills an exact amount.
Swaps sign exactly the quoted amount
Verified
Swap amounts are converted with exact math, so the wallet signs the amount you were quoted.
  • Some amounts, such as 2.01, used to come out slightly off and fail.
  • German and French number formats no longer turn a fraction into 0.
Image resizer works only for our own image hosts
Verified
The app resizes pictures only from its own storage hosts; pictures from anywhere else load directly.
  • A test reads the app's image settings and fails if a catch-all host comes back.
Next.js and sharp updated past critical advisories
Verified
Upgraded to Next.js 15.5.24 and sharp 0.35.5 to close published critical advisories in the older versions.
  • Versions checked in the package file on main.
Open in Keplr from a phone browser
Shipped
On a phone, the connect window offers an Open in Keplr button that reopens the page inside Keplr Mobile.
  • The link it builds is unit-tested; no real-phone tap test is on record.
Fees follow TX's live gas price
Verified
Staking, claiming and sending pay the chain's live gas price instead of a fixed price.
  • Redelegating estimates its gas instead of using a fixed limit, so it no longer runs out of gas.
  • A test fails if the old fixed price is written back into the code.
Development refuses the live database
Verified
The app's development server refuses to start when its settings point at the production database.
  • A test pins the check to the production project, so it cannot drift.
Every test file runs on every pull request
Verified
Each pull request runs lint, type checks, a database-migration lint and every tracked test file.
  • A test file that runs zero tests counts as a failure, so none is skipped silently.
Pools show who can change their contract
Verified
Each liquidity pool shows whether its contract is locked, or held by a multisig, a contract or one key.
  • Read from chain data: the contract's admin and how many times its code was changed.
PSE page shows the latest distribution
Verified
Latest distribution, epoch counts, staking APR after the community tax, and a pause notice tied to chain state.
  • The pause notice appears only when the chain itself shows a pause, not because of a text proposal.
  • Your PSE history can list up to 84 monthly distributions, up from 12.