Skip to content

payment_escrow does not validate that fee_bps ≤ 10,000 on `initialize #250

Description

@Nabeelahh
  • Area: Smart Contract
  • Description: initialize stores whatever fee_bps value is passed without checking it is a valid basis-point value (0–10,000). A fee above 10,000 bps would attempt to transfer more than the deposited amount, causing an arithmetic underflow and a panic.
  • File(s): contracts/payment_escrow/src/lib.rs
  • Priority: High
  • Implementation & verification: Treat this as a protocol-safety change: check authorization, storage/ABI compatibility, ledger-time behavior, and emitted events before changing the implementation. Add a contract-level regression test for both the invalid and successful paths.
  • Required change set (2–6 files): Change the relevant contract implementation together with its focused contract test, and include a type, error, or deployment-script adjustment only when required.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Labels

Stellar WaveIssues in the Stellar wave program

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions