Repository navigation
contract: implement anti-frontrunning commit-reveal mechanism for competitive payroll bounty claims #212
Description
Problem
When competitive payroll bounties or task rewards are published on-chain, frontrunning bots monitoring the public Stellar mempool can observe valid proof submissions, extract the solution payload, and submit their own claim with a higher gas fee to steal the reward before the legitimate contributor's transaction confirms.
Task
Implement a cryptographic commit-reveal claim scheme in contracts/soroban/src/lib.rs:
- Commit Phase:
- Contributor submits commitment hash:
commit_bounty_claim(env, claimant: Address, bounty_id: u64, commitment_hash: BytesN<32>). - Store commitment with current ledger sequence:
commitment_hash = SHA256(claimant || proof || secret_salt).
- Contributor submits commitment hash:
- Challenge Delay Window:
- Enforce a minimum delay of 5 ledgers (~25 seconds) before the reveal phase opens to prevent same-block mempool copying.
- Reveal Phase:
- Contributor submits
reveal_bounty_claim(env, claimant, bounty_id, proof, secret_salt). - Contract verifies preimage matches stored commitment, validates bounty solution, and dispatches token payout to
claimant.
- Contributor submits
Acceptance criteria
- Two-phase commit-reveal process prevents mempool copy-paste frontrunning
- Reveal submissions before challenge delay window are rejected
- Invalid preimages or mismatched claimant addresses panic
- Unit tests in
contracts/soroban/src/test.rstest full commit-reveal workflow, early reveal rejection, and tampered preimage attacks -
cargo testpasses cleanly
Getting started
See CONTRIBUTING.md for setup. Run cd contracts/soroban && cargo test.
Activity
liutingqiu commentedon Oct 19, 2026
@liutingqiu has applied to work on this issue as part of the Stellar Wave Program's 10th wave.
ℹ️ Repo Maintainers: To accept this application, review their application or assign @liutingqiu to this issue.
yodakkak commentedon Oct 19, 2026
@yodakkak has applied to work on this issue as part of the Stellar Wave Program's 10th wave.
ℹ️ Repo Maintainers: To accept this application, review their application or assign @yodakkak to this issue.
markankamaransheogarat-sys commentedon Oct 19, 2026
Implemented the cryptographic commit-reveal anti-frontrunning mechanism and submitted in PR #214 with full 134/134 green unit test coverage and architectural threat model documentation.
Aabidah-06 commentedon Oct 19, 2026
@Aabidah-06 has applied to work on this issue as part of the Stellar Wave Program's 10th wave.
ℹ️ Repo Maintainers: To accept this application, review their application or assign @Aabidah-06 to this issue.
drips-wave commentedon Oct 19, 2026
Congratulations, @Aabidah-06! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on October 22, 2026.
🧑💻 @Aabidah-06: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.
Warning
When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.
🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.
🌊 Happy Wave 🌊
feat(soroban): escrow competitive bounty rewards behind authenticated…
test(soroban): cover bounty settlement, early reveal, tampered preima…
fix(soroban): repair two pre-existing unclosed tests blocking upstrea…
feat: milestone payroll escrow, verified mobile handover, GraphQL str…
drips-wave commentedon Oct 19, 2026
This issue has been completed by @Aabidah-06 as part of the Stellar Wave Program's 10th Wave 🥳
😎 @Aabidah-06: You earned 200 Points for completing this issue! Once the Wave's rewards are finalized, you'll be eligible for a percentage of the Wave's reward pool based on the percentage of total points you've earned. Learn more here. You can also Leave a review to share your experience working on this issue.
🧑💻 Repo maintainers: How'd the contributor do? Leave a review to share your experience working with them.
markankamaransheogarat-sys commentedon Oct 20, 2026
Notice to maintainers @Prudentdev-xyz, @Abdqoharr and @drips-wave:
The implementation of this issue merged via PR #218 was authored and submitted hours earlier by @markankamaransheogarat-sys in PR #214. Please review the formal attribution dispute and cryptographic git audit trail here:
#218 (comment)