Add `claim_with_proof` Merkle proof length cap

[kilodesodiq-arch]

Problem Statement. claim_with_proof walks the proof vector linearly with no upper
bound. A malicious user could submit a 1-million-element proof as a JSON-encoded
Vec<String> that the contract will iterate.

Why it matters. Resource DoS on Soroban is bound by wasm CPU; not bounding the proof
length is a free lever for an attacker.

Technical Context. verify_merkle_proof_for_claimant runs in loop { current = hash_pair(...) }. The claim_with_proof accepts any Vec<String>. There is no
MAX_PROOF_LENGTH config field today.

Expected Outcome. New Error::ProofTooLarge returned when proof.len() > config.max_proof_length.

Acceptance Criteria.

• Test passes a 256-element proof → returns ProofTooLarge.
• Test passes a 4-element valid proof → status == Claimed.
• Default cap is 32; configurable via set_config to a max of 64.

Implementation Notes. Use the existing claim_with_proof entry point; add a config
load at the top of the function.

Files or modules likely to be affected. src/lib.rs, tests/aid_escrow_tests.rs.

Difficulty. Easy
Estimated effort. S

---

---

Backlog item #19 from `docs/maintainer-issue-backlog.md.

[Jumongweb]

Hi maintainer, i will like to solve this issue

[Justprotocol]

Hi Maintainer,

I would love to handle this issue to prevent resource DoS vectors on your proof verification flow. As a full-stack developer with experience writing smart contracts in Rust/Soroban, handling vector parsing safely, and implementing strict test coverages, I'm well-equipped to implement this guard cleanly.

My approach to fixing this:

Extend Contract Configuration: Introduce a dynamic max_proof_length configuration field in the contract storage (defaulting to 32, configurable via set_config up to a hard cap of 64).

Implement Check in claim_with_proof: Load the current configuration at the top of the entry point in src/lib.rs and assert that the proof length (proof.len()) is within our configured bounds.

Handle Errors: Return a clear, custom error, Error::ProofTooLarge—when the vector exceeds the limits.

Write Tests: Add test cases in tests/aid_escrow_tests.rs to verify that a 256-element proof is rejected with ProofTooLarge, while a valid 4-element proof successfully processes with the Claimed status.

I'm ready to dive into the codebase and get this implemented immediately!

[grantfox-oss]

🦊 GrantFox — @Justprotocol has been assigned to this issue as part of the Official Campaign | FWC26 campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #227)
2. Your PR will be reviewed by the ChainForgee maintainers

Good luck! Track your progress on GrantFox.

[grantfox-oss]

🎉 This issue has been marked as completed on GrantFox as part of the Official Campaign | FWC26 campaign!

@Justprotocol's PR #348 was approved and merged by @kilodesodiq-arch.

🏆 @Justprotocol: You earned 35 FoxPoints for this contribution! Your current tier: Explorer (146 total points). Track your full progress on GrantFox.

👏 Great work, @Justprotocol! Keep contributing to ChainForgee.