[MEDIUM] — CSV donation export hardcodes `"USD Equivalent" = 0.00`; downstream consumers may trust the column for tax / accounting workflows

[Alqku]

Severity: Medium
Type: Bug
Scope: Donations, Users
Labels: bug, security, help wanted

Description

Both the synchronous and asynchronous export paths emit a hardcoded 0.00 USD equivalent:

• UsersService.exportUserDonationsAsCSV (src/users/users.service.ts, line ~415).
• ExportProcessor.handleDonationExport (src/users/export.processor.ts, line ~58).
  The comment in each location acknowledges this is a placeholder ("USD equivalent: fetched from price cache in production").

Two failure modes persist today:

1. Users downloading the CSV for tax/accounting will see a 0.00 value and may trust it.
2. If a future consumer (analytics dashboard, partner integration) ingests the CSV preemptively, the integration will be biased.

Recommendation

• Drop the column entirely until a real price-oracle integration is added, or rename it to Quote: pending.
• When ready, integrate a price oracle (Stellar Horizon /order_book snapshots, CoinGecko, or a self-hosted oracle service) and cache quotes with TTL by asset.
• Document the absence in README.md so external integrators are not surprised.

---

[iyanumajekodunmi756]

Hi maintainer, I would love to work on this issue. I have studied the details of the issue description and I understood the requirements. I shall deliver with qualitative feedback and promptly.

[grantfox-oss]

🦊 GrantFox — @iyanumajekodunmi756 has been assigned to this issue as part of the Official Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #15)
2. Your PR will be reviewed by the OrbitChainLabs maintainers

Good luck! Track your progress on GrantFox.