Issues

• Harden LND credential and settings file permissions

  bugsecuritystatus: accepted
  MostroP2P/mostro#1014 · Filter by author arkanoider opened on Oct 1, 2026
  

• mostro-p2p.tech times out via Tor while direct WebSocket succeeds

  MostroP2P/mostro#1007 · Filter by author johnvolldepp opened on Sep 29, 2026

• Fiat amounts are integer-only: decimals are silently truncated (~2% error on a 25.49 EUR order)

  MostroP2P/mostro#1002 · Filter by author alanbimbati opened on Sep 28, 2026

• price: get() serves a future-stamped price as fresh (negative age passes any TTL)

  MostroP2P/mostro#974 · Filter by author arkanoider opened on Sep 22, 2026

• Makers shouldn't have to watch their orders: a maker window, and clients that pay the escrow

  MostroP2P/mostro#973 · Filter by author BBakker26 opened on Sep 22, 2026
  1

• release_action settles the escrow before its status CAS — #809's deferred half, and why a claim-first fix does not work

  MostroP2P/mostro#972 · Filter by author ToRyVand opened on Sep 22, 2026
  2

• send_dm returns Ok and the queue drops the message when the Nostr client is unset

  MostroP2P/mostro#960 · Filter by author ToRyVand opened on Sep 11, 2026

• Carry observation time on AggregateResult instead of reading it from provider state after the tick

  MostroP2P/mostro#959 · Filter by author ToRyVand opened on Sep 7, 2026
  3

• .mutants.toml is never loaded — wrong path, and four of its keys are invalid

  MostroP2P/mostro#958 · Filter by author ToRyVand opened on Sep 7, 2026

• hold_invoice_expiration_window duplicates expiration_seconds and loses

  MostroP2P/mostro#955 · Filter by author 21Mill opened on Sep 6, 2026

• SQLITE_BUSY under concurrent writes drops user actions (a fiat-sent was lost on regtest)

  MostroP2P/mostro#954 · Filter by author grunch opened on Sep 4, 2026

• Count in-flight payouts from a TrackPayments subscription instead of scanning ListPayments

  Medium Priority
  MostroP2P/mostro#953 · Filter by author grunch opened on Sep 4, 2026

• Weekly mutation audit never completes: killed at GitHub's 6h limit on every scheduled run

  MostroP2P/mostro#930 · Filter by author ToRyVand opened on Aug 31, 2026
  1

• ci.yml runs on push only, so fork pull requests are never built

  MostroP2P/mostro#929 · Filter by author ToRyVand opened on Aug 31, 2026
  1

• job_expire_pending_older_orders still expires pending orders while the inbox is down

  MostroP2P/mostro#926 · Filter by author AndreaDiazCorreia opened on Aug 29, 2026

• Anti-abuse bond: an LND-side cancel of a Locked bond is silently treated as a release — breaks dispute slashing and contributed to a force-close

  MostroP2P/mostro#920 · Filter by author 21Mill opened on Aug 23, 2026

• [MEDIUM] show_cashu_escrow_request full-row write reverts a concurrent maker trade-pubkey rotation

  MostroP2P/mostro#919 · Filter by author AndreaDiazCorreia opened on Aug 23, 2026

• [LOW] trade_index is not rotated alongside the maker trade pubkey

  MostroP2P/mostro#912 · Filter by author grunch opened on Aug 21, 2026

• [MEDIUM] in-flight take still messages the maker's pre-rotation trade key

  MostroP2P/mostro#911 · Filter by author grunch opened on Aug 21, 2026

• Dead code: migrate_remove_token_columns can never run — legacy DBs abort earlier on a sqlx checksum mismatch

  area: databasepriority: mediumrefactor
  MostroP2P/mostro#906 · Filter by author grunch opened on Aug 20, 2026

• [MEDIUM] release_action settles the hold invoice before its CAS guard (split from #809)

  area: lightningarea: ordersbugpriority: medium
  MostroP2P/mostro#904 · Filter by author grunch opened on Aug 20, 2026

• [MEDIUM] The #866 pre-trade CAS sweep missed the scheduler: full-row writes can resurrect or clobber pre-trade orders

  MostroP2P/mostro#902 · Filter by author AndreaDiazCorreia opened on Aug 19, 2026

• Remove ValidateDbPassword: a no-op endpoint that always returns success

  area: adminpriority: lowrefactor
  MostroP2P/mostro#901 · Filter by author AndreaDiazCorreia opened on Aug 19, 2026

• Admin RPC callers act as the daemon key: no per-operator identity, audit trail, or scoped revocation

  area: adminenhancementpriority: mediumsecurity
  MostroP2P/mostro#900 · Filter by author AndreaDiazCorreia opened on Aug 19, 2026

• Restore session can return more orders than the orders action accepts

  area: ordersbug
  MostroP2P/mostro#898 · Filter by author AndreaDiazCorreia opened on Aug 19, 2026