[euniceamoni]

Closes #1795
Closes #1797

Issues

#1795 CI: ABI snapshot check does not run on forks, so ABI regressions are not caught on PRs

Category: CI/CD
Priority: Low
Estimated Time: 30 minutes

Description:
The abi-snapshot.yml workflow uses a secret to push the updated snapshot, which means it skips the comparison check on pull requests from forks. ABI-breaking changes in fork PRs are not flagged.

Tasks:

• Restructure the workflow to perform the comparison check in a pull_request trigger (read-only, no secrets needed)
• Only push the updated baseline on push to main

#1797 Security: migrate_state has no version guard, allowing downgrade migrations

Category: Escrow Contract - Security
Priority: Medium
Estimated Time: 1 hour

Description:
migrate_state does not check that target_version > current_version, so a malicious or mistaken admin call could trigger a downgrade migration, potentially corrupting storage layout.

Tasks:

• Add a check: if target_version <= current_version return Error::InvalidVersion
• Add a test asserting downgrade is rejected

Summary

Issue 1797's guard and tests appear largely present already; the work is to verify the guard is the first check after auth in migrate_state, confirm Error::InvalidVersion exists, and ensure a downgrade-rejection test asserts both the error and that the stored version is unchanged. For issue 1795, the key change is decoupling the read-only comparison (pull_request, no secrets, contents: read) from the baseline push (push to main only, uses secret). Do not reference secrets in the pull_request job so fork PRs run the comparison.

Changes

• Restructure the ABI snapshot workflow so the comparison check runs on every pull_request (including forks) without secrets, and the baseline push only runs on push to main. Split into two jobs: (1) a compare job triggered on pull_request with permissions: contents: read that checks out the PR, builds the escrow WASM, installs the Stellar CLI, extracts current function names, extracts baseline function names, and diffs them (failing on mismatch) — no secrets referenced; (2) an update-baseline job triggered only on push to main/master that regenerates the snapshot and commits/pushes the updated contracts/escrow/contract-spec.json using the secret token. Keep the existing path filters and build/extract steps, moving the secret-dependent push logic into the push-only job. (.github/workflows/abi-snapshot.yml)
• Verify that migrate_state in the escrow contract enforces the version guard: after loading the admin and the stored current version (defaulting to CONTRACT_VERSION), it must return Error::InvalidVersion when target_version <= current before any storage mutation or migration is applied. The guard is already present in the shown code; confirm it is intact and that Error::InvalidVersion exists in the error enum. No behavioural change is expected here, but ensure the guard remains the first check after auth. (contracts/escrow/src/lib.rs)
• Confirm that Error::InvalidVersion is defined in the escrow error enum (it is currently InvalidVersion = 49). If it were missing, add it with a stable unused discriminant and update docs/error-codes.md accordingly. No change is expected if the variant already exists. (contracts/escrow/src/errors.rs)
• Add a test in the upgrade test module asserting that a downgrade migration is rejected: initialize the contract, advance the version via migrate_state to a higher value (e.g. 1_001), then call try_migrate_state with a lower target (e.g. crate::CONTRACT_VERSION / 1_000) and assert it returns Err(Ok(Error::InvalidVersion)); also assert get_version() is unchanged after the rejected call. Ensure the existing same-version and lower-version rejection tests remain and cover the guard. (contracts/escrow/src/tests/upgrade.rs)