Repository navigation
Conversation
…ol#521 stellar-vortex-protocol#522 stellar-vortex-protocol#523 stellar-vortex-protocol#520 — Remove stale placeholder begin_fill and duplicate fill_intent_inner The placeholder begin_fill (no token escrow, labeled 'For now, this is a placeholder') has been removed; the complete implementation with pull_exact escrow already existed below it. The duplicate fill_intent_inner stub (with a require_proof param but no body) has been merged into the single canonical definition. stellar-vortex-protocol#521 — Implement per-solver bond tracking in accept_outbound_intent Replaced the 'Store solver bond (simplified — real impl would track per-solver)' comment block with real per-solver tracking: loads the solver's SolverRecord (requires solver to be registered), credits the posted bond via set_solver_bond_amount (keeping bond_amount, bond_tokens, and DataKey::SolverBond in sync per stellar-vortex-protocol#187), increments active_intents, and pulls the bond from the solver into the contract via pull_exact (stellar-vortex-protocol#409) for fee-on-transfer safety. Removes the unused cfg load. stellar-vortex-protocol#522 — Implement IntentFillHistory writes in fill_intent_inner fill_intent_inner now appends (solver, fill_amount, now) to DataKey::IntentFillHistory on every fill, with FIFO eviction once MAX_FILL_HISTORY (10) entries is reached and extend_ttl after every append. Resolves the FIXME(fill-history-ttl) in test_archival.rs: intent_fill_history_ttl_bumped_if_key_exists now asserts the key exists and its TTL meets PERSISTENT_TTL_EXTEND_TO rather than skipping conditionally. stellar-vortex-protocol#523 — Broaden SECURITY.md threat model beyond intent_settlement Added dedicated threat-model sections for solver_registry (bond custody, writer blast radius, obligation-lock griefing), proof_registry (Axelar path production gap, Guardian quorum, emitter allowlist, freshness window), reputation_badge (dual authority, TTL silent expiry), backstop_vault (settlement immutability, emergency mode, insolvency path, inflation attack mitigation), and arbiter_panel (PRNG predictability, abstention griefing, immutable post-deploy params).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Batch fix for four high-severity issues found in the same audit pass.
closes #520 — Remove stale
begin_fillplaceholder and duplicatefill_intent_innerRoot cause: Two
begin_filldefinitions existed in the same#[contractimpl]block — a placeholder labeled "For now, this is a placeholder establishing the interface" (no token transfer, weaker auth) and the complete implementation below it. There was also a bodylessfn fill_intent_innerstub with arequire_proofparameter shadowing the real definition.Fix: Remove the placeholder
begin_fillentirely (the full escrow implementation withpull_exactand scoped auth already existed). Merge the duplicatefill_intent_innerstub into the single canonical definition.closes #521 — Per-solver bond tracking in
accept_outbound_intentRoot cause: "Store solver bond (simplified — real impl would track per-solver)" —
bond_amountwas validated but discarded. No tokens were transferred from the solver;SolverRecordwas never updated.Fix: Load solver's
SolverRecord, credit bond viaset_solver_bond_amount(#187), incrementactive_intents, pull bond viapull_exact(#409) with fee-on-transfer correction. Remove unusedcfgload.closes #522 — Implement
IntentFillHistorywritesRoot cause:
DataKey::IntentFillHistorywas defined but never written.test_archival.rsheld aFIXME(fill-history-ttl)skip guard.Fix:
fill_intent_innernow appends(solver, fill_amount, now)with FIFO eviction atMAX_FILL_HISTORY=10andextend_ttlafter every write. Test hardened to assert unconditionally.closes #523 — Broaden
SECURITY.mdthreat modelRoot cause: Threat model was scoped to
intent_settlementonly.solver_registry,backstop_vault,arbiter_panelcustody real value with no published threat model.Fix: Added dedicated sections for
solver_registry,proof_registry,reputation_badge,backstop_vault, andarbiter_panelcovering assets at risk, trust assumptions, and known limitations including the Axelar production gap, PRNG panel predictability, and obligation-lock griefing.Files changed
intent_settlement/src/lib.rsbegin_fill; remove duplicatefill_intent_innerstub; outbound per-solver bond pull;IntentFillHistorywritesintent_settlement/src/test_archival.rsSECURITY.mdCloses #520, #521, #522, #523