Conversation
The markets header only showed figures for the selected market. Aave-wide numbers (every version, every chain) now sit ahead of them, with a tooltip breaking the total down by protocol version. The v3 data sources are market-scoped, so the figures come from TokenLogic's markets snapshot through a new server route, /api/protocol-totals. The route reads TL_API_KEY, prices token-unit deposits and borrows by reserve_price, groups by protocol, and lets the CDN cache a good reading for 30 minutes. Errors are never cached and the header renders nothing until a reading exists, so an unconfigured key leaves the page as it was.
Mjolnir Security ReviewNew commits since last review at 19 PRs reviewed · 1 finding |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 873571f476
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| return useQuery<ProtocolTotals>({ | ||
| queryKey: ['protocol-totals'], | ||
| queryFn: async () => { | ||
| const response = await fetch('/api/protocol-totals'); |
There was a problem hiding this comment.
The production workflow in .github/workflows/build-test-deploy.yml invokes the composite build action, whose default command is build:static, and deploys the resulting out directory to IPFS for app.aave.com. That export contains no pages/api functions, so in production this same-origin request returns 404 and ProtocolTotalsStats renders nothing. The totals must come from an endpoint deployed independently of the static bundle or be included in the exported data.
Useful? React with 👍 / 👎.
| const totals = await fetchProtocolTotals(apiKey); | ||
| res.setHeader('Cache-Control', CACHE_CONTROL); |
There was a problem hiding this comment.
In server-hosted deployments, this public route ignores req.query while its CDN cache is keyed by the requested URL. A caller can therefore request /api/protocol-totals?nonce=<unique> repeatedly, forcing a fresh authenticated TokenLogic request each time and defeating the cache intended to protect the upstream quota. Reject unexpected query parameters or cache the upstream result under a fixed server-side key.
Useful? React with 👍 / 👎.
📦 Next.js Bundle Analysis for aave-uiThis analysis was generated by the Next.js Bundle Analysis action. 🤖
|
| Page | Size (compressed) |
|---|---|
global |
1.34 MB (🟡 +1.28 KB) |
Details
The global bundle is the javascript bundle that loads alongside every page. It is in its own category because its impact is much higher - an increase to its size means that every page on your website loads slower, and a decrease means every page loads faster.
Any third party scripts you have added directly to your app using the <script> tag are not accounted for in this analysis
If you want further insight into what is behind the changes, give @next/bundle-analyzer a try!
Sixteen Pages Changed Size
The following pages changed size from the code in this PR compared to its base branch:
| Page | Size (compressed) | First Load |
|---|---|---|
/ |
93.08 KB (🟡 +1.18 KB) |
1.43 MB |
/404 |
2.11 KB (🟢 -1 B) |
1.34 MB |
/500 |
2.44 KB (🟢 -1 B) |
1.34 MB |
/bridge |
38.26 KB (🟢 -138 B) |
1.37 MB |
/dashboard |
81.73 KB (🟢 -92 B) |
1.42 MB |
/faucet |
11.37 KB (🟢 -105 B) |
1.35 MB |
/governance |
43.18 KB (🟡 +108 B) |
1.38 MB |
/governance/ipfs-preview |
97.74 KB (🟡 +96 B) |
1.43 MB |
/governance/v3/proposal |
84.5 KB (🟡 +82 B) |
1.42 MB |
/history |
28.62 KB (🟢 -3.95 KB) |
1.37 MB |
/markets |
54.24 KB (🟡 +1.23 KB) |
1.39 MB |
/reserve-overview |
39 KB (🟡 +108 B) |
1.38 MB |
/safety-module |
55.26 KB (🟡 +77 B) |
1.39 MB |
/sgho |
92.33 KB (🟡 +77 B) |
1.43 MB |
/staking |
31.45 KB (🟢 -62 B) |
1.37 MB |
/v3-migration |
48.59 KB (🟢 -57 B) |
1.38 MB |
Details
Only the gzipped size is provided here based on an expert tip.
First Load is the size of the global bundle plus the bundle for the individual page. If a user were to show up to your website and land on a given page, the first load size represents the amount of javascript that user would need to download. If next/link is used, subsequent page loads would only need to download that page's bundle (the number in the "Size" column), since the global bundle has already been downloaded.
Any third party scripts you have added directly to your app using the <script> tag are not accounted for in this analysis
Next to the size is how much the size has increased or decreased compared with the base branch of this PR. If this percentage has increased by 20% or more, there will be a red status indicator applied, indicating that special attention should be given to this.
|
![aave-code-review[bot]](https://avatars.githubusercontent.com/u/47617460?s=60&v=4){kind=small}
|
📦 Next.js Bundle Analysis for aave-uiThis analysis was generated by the Next.js Bundle Analysis action. 🤖
|
| Page | Size (compressed) |
|---|---|
global |
1.34 MB (🟡 +1.26 KB) |
Details
The global bundle is the javascript bundle that loads alongside every page. It is in its own category because its impact is much higher - an increase to its size means that every page on your website loads slower, and a decrease means every page loads faster.
Any third party scripts you have added directly to your app using the <script> tag are not accounted for in this analysis
If you want further insight into what is behind the changes, give @next/bundle-analyzer a try!
Sixteen Pages Changed Size
The following pages changed size from the code in this PR compared to its base branch:
| Page | Size (compressed) | First Load |
|---|---|---|
/ |
93.08 KB (🟡 +1.18 KB) |
1.43 MB |
/404 |
2.11 KB (🟢 -1 B) |
1.34 MB |
/500 |
2.44 KB (🟢 -1 B) |
1.34 MB |
/bridge |
38.26 KB (🟢 -138 B) |
1.37 MB |
/dashboard |
81.73 KB (🟢 -92 B) |
1.42 MB |
/faucet |
11.37 KB (🟢 -105 B) |
1.35 MB |
/governance |
43.18 KB (🟡 +108 B) |
1.38 MB |
/governance/ipfs-preview |
97.74 KB (🟡 +96 B) |
1.43 MB |
/governance/v3/proposal |
84.5 KB (🟡 +82 B) |
1.42 MB |
/history |
28.62 KB (🟢 -3.95 KB) |
1.37 MB |
/markets |
54.24 KB (🟡 +1.23 KB) |
1.39 MB |
/reserve-overview |
39 KB (🟡 +108 B) |
1.38 MB |
/safety-module |
55.26 KB (🟡 +77 B) |
1.39 MB |
/sgho |
92.33 KB (🟡 +77 B) |
1.43 MB |
/staking |
31.45 KB (🟢 -62 B) |
1.37 MB |
/v3-migration |
48.59 KB (🟢 -57 B) |
1.38 MB |
Details
Only the gzipped size is provided here based on an expert tip.
First Load is the size of the global bundle plus the bundle for the individual page. If a user were to show up to your website and land on a given page, the first load size represents the amount of javascript that user would need to download. If next/link is used, subsequent page loads would only need to download that page's bundle (the number in the "Size" column), since the global bundle has already been downloaded.
Any third party scripts you have added directly to your app using the <script> tag are not accounted for in this analysis
Next to the size is how much the size has increased or decreased compared with the base branch of this PR. If this percentage has increased by 20% or more, there will be a red status indicator applied, indicating that special attention should be given to this.
1 participant
General Changes
/api/protocol-totals, a server route that reads TokenLogic's markets snapshot withTL_API_KEY, prices token-unit deposits and borrows byreserve_price, groups rows by protocol, and returns USD totals. Good readings carry a 30-minute CDN cache header; errors are never cached.Context: #aave-v3-app thread. Same approach as Pro's ecosystem totals (aave/aave-pro#1443), pulling straight from TokenLogic rather than importing a second aave-kit instance.
Developer Notes
TL_API_KEY(TokenLogic REST API). It is a different credential from the HasuraTOKENLOGIC_API_KEYalready used for sGHO APY; that key returns 401 on the REST endpoint. Same name as Pro so the Vercel secret can be copied over. Needs to be set on Vercel for the stats to appear.protocolids areaave_v2,aave_v3andaave_v4(verified on the preview deployment after the key was added). The UI maps ids onto "Aave V1..V4" by matching av1..v4token and shows the raw id for anything else.reserve_priceand rejects empty or non-numeric fields while still accepting a genuine0.Reviewer Checklist
Please ensure you, as the reviewer(s), have gone through this checklist to ensure that the code changes are ready to ship safely and to help mitigate any downstream issues that may occur.
.env.examplefile as well as the pertinant.github/actions/*files