Spec drift: limitless — /profiles/public/{addr} called in client.ts but absent from spec; PortfolioController_getTrades bypassed

[realfishsam]

Exchange

limitless

Drift Type

new_endpoint (undocumented bypass)

Severity

MEDIUM — undocumented endpoint used in production code; any breakage of this endpoint would be invisible at the spec level

Their Docs

Source: https://api.limitless.exchange (spec endpoint not publicly documented; discovered via code inspection)

The endpoint /profiles/public/{addr} is called in core/src/exchanges/limitless/client.ts:245 but does not appear in:

• core/specs/limitless/Limitless.yaml
• core/src/exchanges/limitless/api.ts (which has 29 defined operationIds)
• Any public documentation found

Our Cached Spec

core/specs/limitless/Limitless.yaml — /profiles/public/{addr} is absent. The spec covers /portfolio/..., /markets/..., /orders, /auth/... but not a /profiles/ namespace.

callApi() References at Risk

None — client.ts accesses this endpoint via the Limitless SDK's HttpClient directly (bypassing callApi()):

• GET /profiles/public/${addr} at client.ts:245 — used to resolve profile.id and profile.feeRateBps before order submission

Hardcoded URL Bypasses

• /profiles/public/${addr} (GET, SDK HttpClient) at client.ts:245 — not in spec; used to resolve profile ID and fee rate before placing orders
• /orders (POST, SDK HttpClient) at client.ts:219, 301 — bypasses SDK OrderClient for smart-wallet and delegated order submission
• ${this.apiUrl}/portfolio/trades (GET, Axios, bearer auth) at fetcher.ts:193 — bypasses callApi() for PortfolioController_getTrades (which IS in the spec as PortfolioController_getTrades: GET /portfolio/trades) but the fetcher avoids using it via callApi()
• ${this.apiUrl}/markets/active (GET, Axios, query params) at fetcher.ts:362 — bypasses callApi() for MarketController_getActiveMarkets (in spec)
• /markets/${marketSlug}/user-orders (GET, SDK HttpClient) at client.ts:345 — bypasses callApi() for MarketOrderbookController_getUserOrders (in spec)

Impact

If Limitless changes or removes /profiles/public/{addr} without announcement, all order placement will silently fail — the fee rate resolution step at client.ts:245 would throw or return undefined, and order sizing/submission would be incorrect. Because the endpoint is not in the spec, spec-drift audits would not catch a change to it. The endpoint should be formally added to Limitless.yaml so it can be tracked.

---

Found by automated spec drift audit