[mskdylan]

Summary

The new tests exposed two small production defects directly tied to these issues:

1. useStreamingAmount leaked NaN into the rendered claimable value when ratePerSecond was non-finite. It now treats a non-finite/negative rate as zero.
2. useSettings trusted any persisted preference. Invalid decimals, currencies, and formats now fall back to the documented defaults (7, USD, full) on hydration and in the synchronous getters.

Dependency audit update

• npm advisories resolved: next 16.3.8 → 16.4.3 (GHSA-2464-fhr4-w9xw, GHSA-p3m5-59mp-jv5r, GHSA-673q-mjm6-r5xr), plus lockfile updates for zod 4.6.7, body-parser 2.4.0, fast-uri 3.1.9, and ip-address 10.7.4. All three npm audit --omit=dev gates now report 0 vulnerabilities in CI.
• Remaining blocker: cargo audit reports RUSTSEC-2026-0387 for crypto-bigint 0.5.5. It is pulled in by soroban-env-host 22.1.3 → elliptic-curve 0.13.8 → crypto-bigint 0.5.5. Every current soroban-env-host release through 30.0.0 still requires elliptic-curve ^0.13.5, and elliptic-curve 0.13.x requires crypto-bigint ^0.5; the advisory is only patched in crypto-bigint >=0.7.6, which needs elliptic-curve >=0.14. There is no compatible in-repo version bump, and no ignore entry or workflow suppression was added.
• Follow-up: bump soroban-sdk/soroban-env-host once upstream migrates to elliptic-curve 0.14+/crypto-bigint 0.7.6, or coordinate a reviewed backport with the Soroban/RustCrypto maintainers.

Files changed

• frontend/src/hooks/useStreamingAmount.test.tsx
• frontend/src/__tests__/useStreamEvents.test.tsx
• frontend/src/hooks/useSettings.test.ts
• frontend/src/hooks/useStreamingAmount.ts (NaN guard)
• frontend/src/hooks/useSettings.ts (persisted-setting validation/fallback)
• package.json, frontend/package.json, package-lock.json (security updates)

Verification

• Focused hook tests: 113 passed (4 files)
• Frontend suite: 814 passed (80 files)
• Frontend build (next build): passed
• Frontend lint: 0 errors; tsc --noEmit: passed
• Backend build (tsc): passed
• Backend unit suite: 815 passed; 2 token-route tests require a running Postgres and could not run locally
• Local npm audit --omit=dev: 0 vulnerabilities for root, frontend, and backend
• GitHub Actions on 914f596: Frontend CI, CodeQL (js/ts/rust), and Soroban Contracts CI pass. Both security jobs fail only at the shared cargo audit step for RUSTSEC-2026-0387; the npm audit steps pass.

Closes #1781
Closes #1782
Closes #1783
Closes #1784

[mskdylan]

Security check status

The npm audit gates are fixed: all three npm audit --omit=dev --audit-level=high steps now report 0 vulnerabilities in the Security Checks run on 914f596.

Both Security Checks jobs still exit 1, but at the shared cargo audit step, not at any npm step. The failure is a single advisory:

Crate: crypto-bigint 0.5.5
error: 1 vulnerability found!
ID: RUSTSEC-2026-0387
Solution: Upgrade to >=0.7.6

Why this is not caused by this PR

• This PR changes no Rust files; contracts/Cargo.lock is byte-identical to main (8a109b7).
• The advisory was issued 2026-10-23, one day after main's last security run (2026-10-22), which passed. cargo audit downloads the advisory DB at run time, so this affects every branch and every open PR, not this change.

Why it cannot be safely fixed here

• The dependency path is soroban-sdk 22.0.9 → soroban-env-host 22.1.3 → elliptic-curve 0.13.8 → crypto-bigint 0.5.5.
• There is no patched 0.5.x: the only fix is crypto-bigint >=0.7.6, which is a semver-breaking release requiring elliptic-curve >=0.14.
• Every published soroban-env-host release through 30.0.0 (and therefore every soroban-sdk through 29.0.1) still requires elliptic-curve ^0.13.5, so a Soroban SDK bump does not remove it.

I have deliberately not added an ignore entry, --ignore flag, or workflow change: the finding is real for this dependency graph, and suppressing it would hide a legitimate audit result. The correct follow-up is an upstream Soroban/RustCrypto migration to crypto-bigint 0.7.6+; once that lands, bumping soroban-sdk resolves both checks with no local workaround.

Everything else is green on 914f596: Frontend CI, all three CodeQL analyses, Soroban Contracts CI, and the preview build. Locally the frontend suite is 814/814 and the backend build plus 815 unit tests pass.