fix: validate cancellation reason, coverage limit boundary, split bps bounds, and oracle stake

contracts/claims-processor/src/lib.rs

@@ -2157,7 +2157,8 @@ impl ClaimsProcessor {
             .unwrap_or_else(|| panic_with_error!(&env, Error::ClaimNotFound));
 
         // Re-check the cap at release time: the payout may never exceed the
-        // policy's coverage amount (issue #550).
+        // policy's coverage amount (issue #550, #723).
+        // Accepts paid_amount == claim.coverage_amount; rejects strictly if paid_amount > claim.coverage_amount.
         if paid_amount > claim.coverage_amount {
             panic_with_error!(&env, Error::PayoutExceedsCoverage);
         }

contracts/oracle-verifier/src/lib.rs

@@ -347,9 +347,8 @@ impl OracleVerifier {
             panic_with_error!(&env, Error::TooManyOracles);
         }
 
-        // Enforce a minimum economic stake so oracles have skin in the game.
-        // Disabled by default (min_stake == 0) for backward compatibility with
-        // deployments/tests that don't use the staking feature.
+        // Enforce a minimum economic stake so oracles have skin in the game (issue #721).
+        // Reject zero-stake registration when minimum stake is enforced.
         let min_stake: i128 = env
             .storage()
             .instance()
@@ -361,7 +360,7 @@ impl OracleVerifier {
                 .persistent()
                 .get(&StorageKey::OracleStakeAmt(data_type.clone(), oracle.clone()))
                 .unwrap_or(0);
-            if staked < min_stake {
+            if staked <= 0 || staked < min_stake {
                 panic_with_error!(&env, Error::InsufficientStake);
             }
         }

contracts/policy-engine/src/lib.rs

@@ -1084,7 +1084,10 @@ impl PolicyEngine {
     pub fn cancel_policy(env: Env, policyholder: Address, policy_id: u128, reason: soroban_sdk::Bytes) -> i128 {
         policyholder.require_auth();
 
-        // Validate reason length to prevent storage exhaustion from extremely long reasons
+        // Validate reason length to prevent storage exhaustion from extremely long reasons (issue #724)
+        if reason.is_empty() {
+            panic_with_error!(&env, Error::InvalidInput);
+        }
         const MAX_REASON_LENGTH: u32 = 256;
         if reason.len() > MAX_REASON_LENGTH {
             panic_with_error!(&env, Error::ReasonTooLong);

contracts/risk-pool/src/lib.rs

@@ -2108,7 +2108,7 @@ impl RiskPool {
     /// passed/executed proposal — a real design decision, not made here.
     pub fn update_premium_split(env: Env, admin: Address, lp_bps: i128, treas_bps: i128, backstop_bps: i128) {
         Self::require_admin(&env, &admin);
-        if lp_bps < 0 || treas_bps < 0 || backstop_bps < 0 {
+        if lp_bps < 0 || lp_bps > 10_000 || treas_bps < 0 || treas_bps > 10_000 || backstop_bps < 0 || backstop_bps > 10_000 {
             panic_with_error!(&env, Error::InvalidSplit);
         }
         if lp_bps + treas_bps + backstop_bps != 10_000 {
@@ -2132,7 +2132,7 @@ impl RiskPool {
         backstop_bps: i128,
     ) {
         Self::require_admin(&env, &admin);
-        if lp_bps < 0 || treas_bps < 0 || backstop_bps < 0 {
+        if lp_bps < 0 || lp_bps > 10_000 || treas_bps < 0 || treas_bps > 10_000 || backstop_bps < 0 || backstop_bps > 10_000 {
             panic_with_error!(&env, Error::InvalidSplit);
         }
         if lp_bps + treas_bps + backstop_bps != 10_000 {