Skip to content

Add contract validation enhancements across stream, token-vault, and factory - #800

Merged
Jaydbrown merged 1 commit into
conduit-protocol:mainfrom
SarahDoma:feat/issues-785-786-787-788-contract-validation
Oct 18, 2026
Merged

Jaydbrown merged 1 commit into
conduit-protocol:mainfrom
SarahDoma:feat/issues-785-786-787-788-contract-validation

Conversation

@SarahDoma

Copy link
Copy Markdown
Contributor

Summary

#785 — StreamCancelled event includes remaining deposit

  • Added remaining_deposit to cancelled() and force_cancelled() in events.rs
  • Updated both call sites in stream/src/lib.rs

#786 — Validate SEP-0041 transfer return values before updating state

  • All tk.transfer() calls in token-vault/src/lib.rs validated via .map_err()
  • Covers 5 transfer points; prevents state mutations on silent failures

#787 — Validate non-duplicate stream IDs in batch cancel payload

  • Added DuplicateStreamId = 33 to factory/src/errors.rs
  • cancel_batch_streams rejects duplicate addresses before processing

#788 — Verify WASM hash registry prior to instantiating new stream contracts

  • deploy_stream() calls env.ledger().get_wasm(wasm_hash) before deployment
  • Returns Error::InvalidWasmHash if hash not registered

Closes #785
Closes #786
Closes #787
Closes #788

## Summary

Implements four critical contract validation improvements:

### conduit-protocol#785 - StreamCancelled event includes remaining deposit
- Added remaining_deposit parameter to cancelled() and force_cancelled() events
- Provides complete financial breakdown in event logs
- Updated lib.rs calls to pass refund_to_sender as remaining_deposit

### conduit-protocol#786 - SEP-0041 transfer return value validation
- Validates return values from all tk.transfer() calls in token-vault
- Maps transfer errors to appropriate contract errors
- Catches transfer failures before state mutations
- Affects 5 transfer points in lib.rs

### conduit-protocol#787 - Duplicate stream ID validation in batch cancel
- Added DuplicateStreamId error code (33) to factory errors
- Validates non-duplicate stream addresses before batch processing
- Uses Map-backed set for O(log n) duplicate detection
- Rejects batch early if duplicates detected

### conduit-protocol#788 - WASM hash registry verification
- Validates WASM hash exists in Soroban ledger before deployment
- Uses env.ledger().get_wasm() to verify registry
- Prevents deployment failures from stale/invalid hashes
- Early validation in deploy_stream()

Closes conduit-protocol#785
Closes conduit-protocol#786
Closes conduit-protocol#787
Closes conduit-protocol#788
@SarahDoma
SarahDoma requested a review from Jaydbrown as a code owner October 18, 2026 11:36
@drips-wave

drips-wave Bot commented Oct 18, 2026

Copy link
Copy Markdown

@SarahDoma Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

@Jaydbrown
Jaydbrown merged commit 7abf921 into conduit-protocol:main Oct 18, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

2 participants