[cleank0de]

Closes #1707

Summary

Replaces the unauthenticated, unbounded global configure_window setter in AccountabilityVault with a per-vault dispute_window fixed at vault creation (create_vault), bounded to [1 hour, 30 days], and evaluated using checked arithmetic.

What & Why

• Remove configure_window and DataKey::DisputeWindow: configure_window was exposed as an unauthenticated public contract function that allowed any caller to overwrite the dispute window for all vaults across the deployment (e.g., setting 0 to disable disputes globally or u64::MAX to cause arithmetic overflow in dispute_milestone).
• Add per-vault bounded dispute_window via VaultOptions:
  • Added VaultOptions { oracle, guardian, dispute_window } to keep create_vault within Soroban's 10-parameter limit.
  • Enforced bounds [MIN_DISPUTE_WINDOW (3,600s / 1 hour), MAX_DISPUTE_WINDOW (2,592,000s / 30 days)] at create_vault, returning Error::InvalidDisputeWindow = 32 when out of range while keeping existing error numbering stable.
  • Stored dispute_window: u64 on each Vault record.
• Checked arithmetic & missing CheckIn guard in dispute_milestone:
  • dispute_milestone now requires an existing DataKey::CheckIn(index) record (failing with Error::MilestonesIncomplete instead of defaulting verified_at to 0).
  • Uses verified_at.checked_add(vault.dispute_window) so dispute_milestone returns a typed error rather than panicking on overflow near u64::MAX.
• ABI / Caller Note:
  • create_vault now takes VaultOptions ({ oracle, guardian, dispute_window }) instead of separate oracle and guardian arguments, and configure_window has been removed from the spec. Follow-up updates to create_vault argument construction in src/services/soroban.ts are out of scope for this PR.
• Documentation & Spec:
  • Updated contracts/accountability_vault/spec/AccountabilityVault.spec.json, test snapshots, and the function table in contracts/README.md.

spec/AccountabilityVault.spec.json Diff

diff --git a/contracts/accountability_vault/spec/AccountabilityVault.spec.json b/contracts/accountability_vault/spec/AccountabilityVault.spec.json
index 3c9f204..fcc3a2d 100644
--- a/contracts/accountability_vault/spec/AccountabilityVault.spec.json
+++ b/contracts/accountability_vault/spec/AccountabilityVault.spec.json
@@ -7,14 +7,13 @@
                 "String",
                 "Address",
                 "VerifierSet",
-                "Option<Address>",
                 "Address",
                 "i128",
                 "Address",
                 "Address",
                 "u64",
                 "Vec<Milestone>",
-                "Address"
+                "VaultOptions"
             ],
             "result": "Result<(), Error>"
         },
@@ -143,13 +142,6 @@
             ],
             "result": "Result<(), Error>"
         },
-        {
-            "name": "configure_window",
-            "params": [
-                "u64"
-            ],
-            "result": "()"
-        },
         {
             "name": "dispute_milestone",
             "params": [

Test Output

running 6 tests
test test::test_dispute_window_no_overflow_panic ... ok
test test::test_dispute_window_bounds_on_create ... ok
test test::test_dispute_expires_and_slash_proceeds ... ok
test test::test_dispute_windows_independent_per_vault ... ok
test test::test_dispute_without_checkin_record_fails ... ok
test test::test_dispute_within_and_after_window ... ok

test result: ok. 6 passed; 0 failed; 0 ignored; 0 measured; 36 filtered out; finished in 0.63s

[drips-wave]

@cleank0de Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits