audit: 17 unused goldsky subgraphs + 1 broken reference

[thedavidmeister]

Findings

The Rain Open Source goldsky project (`project_clv14x04y9kzi01saerx7bxpg`) has 22 subgraph deployments. The live production registry (pinned in `packages/webapp/src/lib/constants.ts` at `rainlanguage/rain.strategies@befb2c3`) references only 5. The remaining 17 deployments are billing without serving production traffic. Separately, the live settings names a subgraph that does not exist in the project.

Live production references (5 used)

• `ob4-base/2026-02-05-c4ef`
• `ob4-matic/2025-09-23-7ac3`
• `ob4-arbitrum-one/2025-09-18-da5d`
• `metadata-base/2025-07-06-594f`
• `metadata-arbitrum-one/2025-07-06-135f`

Live settings only configures base, polygon, arbitrum.

Deployed but unreferenced by production registry (17)

Stale versions where the chain is still in production:

• `ob4-base`: `2024-12-13-9c39`, `2025-08-09-81cc`, `2025-08-18-2744`, `2025-10-11-a62b` (superseded by `2026-02-05-c4ef`)
• `ob4-matic`: `2024-12-13-d2b4`, `2025-08-09-e4cd` (superseded by `2025-09-23-7ac3`)
• `ob4-arbitrum-one`: `2024-12-13-7435`, `2025-08-09-d9bd` (superseded by `2025-09-18-da5d`)

Chains no longer in production settings:

• `ob4-flare`: `2024-12-13-9dc7`, `2026-03-24-a9f3`
• `ob4-bsc`: `2024-12-13-2244`, `2025-08-09-45c4`
• `ob4-linea`: `2024-12-13-09c7`, `2025-08-09-ab94`
• `ob4-mainnet`: `2024-12-13-7f22`, `2025-08-09-1256`

Old metaboard:

• `mb-base-0x59401C93/0.1` (replaced by `metadata-base/2025-07-06-594f`)

Broken reference in production

The live settings names `mb-polygon/0.1` for the polygon metaboard, but no `mb-polygon` deployment exists in the goldsky project. Polygon metaboard fetches will fail. Tracked separately in #2557.

In-repo references to unreferenced subgraphs

The audit found URLs pointing at unreferenced subgraphs in:

• `crates/cli/src/commands/chart.rs:84` — `ob4-flare/2024-12-13-9dc7` (test fixture)
• `crates/cli/src/commands/chart.rs:86` — `mb-flare-0x893BBFB7/0.1` (test fixture; this subgraph is not deployed at all)
• `crates/js_api/src/registry.rs:757-761` — flare and base ob4/mb URLs (test mock content)
• `packages/ui-components/src/lib/fixtures/settings.yaml` — full historical chain set (fixture)
• `packages/orderbook/test/js_api/dotrainRegistry.test.ts:32-36` — flare and base ob4/mb URLs (test data)

All references are in test/fixture code, not runtime defaults. Tests do not actually fetch from these URLs (the `mb-flare-0x893BBFB7/0.1` URL would 404 today and tests still pass). Deleting the underlying goldsky deployments will not break any production code path or test.

Caveats

• Only the live production webapp's pinned registry was checked. Forks, third-party UIs, or older webapp deploys may still hit the stale URLs.
• `ob4-flare/2026-03-24-a9f3` was deployed a month ago, suggesting flare is still being maintained even though production settings dropped it. Confirm intent before deleting flare deployments.

Suggested actions

• Decide whether flare/bsc/linea/mainnet are intentionally deprecated. If yes, delete all their deployments. If no, add them back to the production settings.
• For chains in active use, delete the older superseded versions and keep only the one referenced from production settings.
• Optionally update test fixtures (`chart.rs`, `registry.rs`, `fixtures/settings.yaml`, `dotrainRegistry.test.ts`) to use placeholder URLs rather than real-looking-but-stale ones, so the test data is not mistaken for live config.

Method

`goldsky subgraph list` against `project_clv14x04y9kzi01saerx7bxpg` cross-referenced with the registry+settings pinned in `packages/webapp/src/lib/constants.ts`.