#104 — Lacks a Reentrancy Guard and (Parity with the Other Emergency Entrypoints)

[Topmatrixmor2014]

Labels: Official Campaign | FWC26 GrantFox OSS Maybe Rewarded contract soroban governance bug

This is a smart-contract issue for the GrantFox FWC26 campaign. Bring cancel_emergency_withdrawal in line with the other emergency entrypoints' guard patterns.

Requirements and Context

contracts/finchippay-contract/src/lib.rs — cancel_emergency_withdrawal (≈ line 1940):

require_not_paused(&env);
admin.require_auth();
let stored = get_admin(&env);
if admin != stored {
    panic!("Unauthorized");
}

• It does not hold ReentrancyGuard::acquire (no external transfer, so lower risk — but inconsistent).
• It does not call require_initialized (relies on get_admin which panics "Contract not initialized" anyway — acceptable).
• It validates admin == get_admin (legacy single admin) while initiate_emergency_withdrawal/approve_emergency_withdrawal use the admin-signer set. Batch-3 feat(contract): add / to the Pauser role (currently only admin can pause) #58 flagged the privileged-entrypoint governance gap generally; this issue is the specific remaining asymmetry: a single legacy key can cancel any pending withdrawal that required N-of-M signer approvals, and can cancel others' withdrawals at will.

Objectives

1. Add ReentrancyGuard::acquire(&env) to cancel_emergency_withdrawal for consistency.
2. Decide and enforce the caller policy: require an admin signer (via get_admin_signers) OR document that the legacy admin may cancel; align with the initiate/approve caller model.
3. Add tests for non-signer cancel attempts and guard parity.

Suggested Execution

1. Fork and branch: git checkout -b fix/emergency-cancel-guards.
2. Patch cancel_emergency_withdrawal in src/lib.rs.
3. Add tests; run cargo fmt --check && cargo clippy -- -D warnings && cargo test.

Acceptance Criteria

• cancel_emergency_withdrawal holds the reentrancy guard.
• Caller policy matches the initiate/approve entrypoints (or is explicitly documented as legacy-only).
• ≥3 tests; cargo test + wasm32v1-none build pass.

Guidelines

• Do not weaken the existing emergency-withdrawal flow; document any policy change.

Timeframe: 24 hours

[github-actions]

🤖 Greptile AI Context

Greptile has indexed this repository and can provide AI-assisted code review
and context for this issue.

How to use Greptile on this issue:

• Comment @greptileai to ask about relevant code, files, or implementation approaches
• Reference specific files or error messages for targeted analysis
• Use @greptileai explain <file> to get an explanation of any file

Greptile is configured with project-specific rules in .greptile/config.json.