Skip to content

RPC: Alchemy first for mainnet and Sepolia, through the server proxy - #426

Merged
rroland10 merged 1 commit into
masterfrom
feat/alchemy-mainnet-proxy-first
Nov 7, 2026
Merged

rroland10 merged 1 commit into
masterfrom
feat/alchemy-mainnet-proxy-first

Conversation

@rroland10

Copy link
Copy Markdown

Problem

app.dex223.io read mainnet only through free public RPCs (publicnode, BlastAPI, Tenderly, then the wallet default). They rate-limit, lag and miss receipts (receiptAwareFallback exists because publicnode's Sepolia node drops some), which is a weak base for a production DEX. On Sepolia the keyed providers sat behind publicnode, and the Infura id from the old source answers "Payment Required".

Change

  • lib/server/rpcProxy.ts: new mainnet upstream, Alchemy (eth-mainnet.g.alchemy.com) with the server-only ALCHEMY_API_KEY.
  • config/wagmi/config.ts: http(rpcProxyUrl("mainnet")) first for mainnet and http(rpcProxyUrl("sepolia")) first for Sepolia; public RPCs follow as fallback, in the same order as before.
  • Test: mainnet goes to Alchemy mainnet only, the key never appears in the response, and without a key the route answers 503.

The key comes from a new Alchemy app dex223-web (Ethereum mainnet + Sepolia, origin allowlist app.dex223.io and test-app.dex223.io; the proxy sends the production Origin). Already set in Vercel for production, preview and development; stored in 1Password "Dex223 - Production" / "Alchemy dex223-web API key". Verified at Alchemy: our origin answers, a foreign origin and a missing origin are refused (403).

Verification

  • apps/web/tests/apiProxies.test.cjs: 13 passing. ESLint clean on the changed files.
  • After merge: probe /api/rpc/mainnet and /api/rpc/sepolia on the staged deployment before promoting.

Load and limits

Every browser read now goes through a Vercel function. The proxy allows 600 calls per minute per IP per instance and batches of up to 20; past that it answers 429 and the browser falls back to the public RPCs. Watch Alchemy usage and Vercel function invocations for the first days.

Open

  • The leaked key in bounty featue/swap-pools-tvl-balances: enhance TVL rendering and loading sta… #71 is not in Randall's Alchemy account (it was committed in Dec 2024); its owner has to revoke it. It is no longer in our code or bundle.
  • Back-end services (liquidator, fee keeper, bots, market-api, cache-api) should move to the separate dex223-backend Alchemy app (1Password "Alchemy dex223-backend API key"); those are production server switches.

Mainnet production read only through public RPCs (publicnode, BlastAPI,
Tenderly), which rate-limit, lag and miss receipts. The /api/rpc proxy now
serves mainnet through Alchemy, and both chains try the proxy first, with
the public RPCs as fallback. The key stays server-side (ALCHEMY_API_KEY,
the new dex223-web app, origin-allowlisted to app and test-app). Without a
key the proxy answers 503, past its per-IP limit 429; both move the
fallback on.
@vercel

vercel Bot commented Nov 7, 2026 •

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
dex223-ui-blog Ready Ready Preview Nov 7, 2026 6:42pm UTC
dex223-ui-web Ready Ready Preview Nov 7, 2026 6:42pm UTC

Request Review

@rroland10
rroland10 merged commit 4594fe8 into master Nov 7, 2026
5 checks passed

This branch was successfully deployed

2 active deployments
Preview – dex223-ui-web — 458a741b Deployed Nov 7, 2026 by vercel[bot]
Preview – dex223-ui-blog — 458a741b Deployed Nov 7, 2026 by vercel[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant