Prediction history endpoint allows unbounded in-memory cache growth

[tg12]

Summary

Public prediction-history requests populate a process-global Map with attacker-controlled cache keys and no eviction policy, creating an unbounded memory growth path.

Evidence

• https://github.com/Juliusolsson05/pharos-ai/blob/main/src/app/api/v1/predictions/history/route.ts#L8-L12 defines a module-global cache and refetch set.
• https://github.com/Juliusolsson05/pharos-ai/blob/main/src/app/api/v1/predictions/history/route.ts#L31-L50 caches results under ${tokenId}:${range} for every requested token.
• https://github.com/Juliusolsson05/pharos-ai/blob/main/src/app/api/v1/predictions/history/route.ts#L53-L69 exposes the route publicly with tokenId taken directly from the query string.
• There is no size bound, eviction strategy, or request authentication.

Why this matters

A public endpoint with an unbounded in-memory cache allows repeated requests for unique tokenId values to grow process memory until the instance is recycled or terminated.

Attack or failure scenario

An automated client cycles through arbitrary token IDs. Even if upstream returns errors for many values, successful or semi-successful responses accumulate distinct cache entries. Memory use grows over time, leading to degraded performance or process restarts under sustained churn.

Root cause

Cache design assumes a small trusted keyspace, but the route accepts untrusted public parameters and stores them indefinitely within the server process.

Recommended fix

1. Bound cache size with LRU or TTL eviction.
2. Validate tokenId against known or recent markets before caching.
3. Add route-level throttling for public callers.
4. Consider moving this cache to a managed shared store with explicit limits.

Acceptance criteria

• The route no longer permits unbounded growth from arbitrary tokenId values.
• Cache behavior has explicit size/TTL limits and eviction tests.
• Invalid or unknown IDs are rejected before expensive fetch/cache work.

Suggested labels

• reliability
• performance
• production-readiness
• bug

Priority

P1 (High)

Severity

High — a public parameter can drive unbounded process memory growth.

Confidence

Confirmed — the cache and key construction are explicit in source.