Gate or clearly label mock and fabricated data returned by API endpoints

[priscaenoch]

Problem

Several API modules return hardcoded, fabricated values presented as real responses, with no indication the data is synthetic: src/api/oracle-feeds.ts (mock prices), src/api/arbitrage.ts (mock cross-chain feeds), src/api/reputation.ts (mock leaderboard chain data), src/api/flash-loans.ts (stub mempool risk), src/api/backfill.ts (mock file URLs and counts), src/api/sandwich.ts (mock patterns), and src/api/data-market.ts (ZK-proof stubs). Returning fabricated financial and risk data as if it were real is misleading and unsafe for any consumer that trusts these responses.

This is a cross-cutting task: solving it properly means establishing one consistent mechanism and applying it across every affected module, then guarding against regressions — not patching a single endpoint.

What needs to be done

• Build a shared mock-data framework in one place: a single MOCK_DATA (or ENABLE_EXPERIMENTAL) configuration flag, off by default, plus a helper/middleware that either blocks synthetic responses or explicitly annotates them ("mock": true) when the flag is on.
• Apply it consistently across every affected module (oracle-feeds, arbitrage, reputation, flash-loans, backfill, sandwich, data-market, and any others surfaced by an audit).
• Update the generated OpenAPI spec so every experimental/mock endpoint is marked as such.
• Add a CI guard that fails when a new endpoint returns fabricated data without going through the framework.
• Document the experimental-vs-production boundary in the README (coordinate with the feature-inventory issue).

Files

• src/config/ (new flag + helper/middleware)
• src/api/oracle-feeds.ts, src/api/arbitrage.ts, src/api/reputation.ts, src/api/flash-loans.ts, src/api/backfill.ts, src/api/sandwich.ts, src/api/data-market.ts
• the OpenAPI spec source
• .github/workflows/ci.yml
• README.md
• tests under tests/

Acceptance deliverables

• No endpoint returns fabricated data in the default configuration without going through the shared framework and being explicitly marked.
• Every mock/experimental endpoint is flag-gated (default off) and marked in the OpenAPI spec.
• A CI guard prevents new ungated mock responses.
• All CI checks pass; the change cannot be merged until CI is green.

Tests to pass

• Tests asserting each listed endpoint returns no fabricated data under the default configuration.
• Test: an endpoint using the framework with the flag enabled returns the explicit mock marker.
• The CI guard fails on a deliberately added ungated mock response.

[josunday002]

hi maintainer can i please work on this issue

[dev-fani]

Can i solve this issue, fabricated financial data is more than a mock data issue, it can become a trust and safety problem for anyone consuming the API.

I’ll build a shared mock data framework, apply it across all affected modules, clearly expose experimental responses in OpenAPI, and add CI checks to prevent new ungated mocks. The goal is a consistent production safe boundary rather than a collection of one off fixes.

[grantfox-oss]

🦊 GrantFox — @dev-fani has been assigned to this issue as part of the Third Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #7)
2. Your PR will be reviewed by the octraban maintainers

Good luck! Track your progress on GrantFox.