`propose_certificate` performs no caller authorization (impersonation / spam)

[feyishola]

Neither propose_certificate implementation calls issuer.require_auth() — in lib.rs the intended call is the orphaned stray statement at line 879 (outside the function), and multisig.rs:122-168 has none. Any account can create a PendingRequest naming an arbitrary issuer/proposer and pollute that issuer's and its signers' request indexes (IssuerRequestIds/SignerRequestIds) — an unauthenticated spam/DoS vector against paginated queries. Fix: add issuer.require_auth(); as the first line of both functions.

[dot-enny]

@dot-enny has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Can i work on this ?

ℹ️ Repo Maintainers: To accept this application, review their application or assign @dot-enny to this issue.

[Akintobidavid]

@Akintobidavid has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

I’ve reviewed the issue and can add issuer.require_auth() as the first line of both propose_certificate implementations, preventing unauthenticated users from creating arbitrary pending requests and polluting issuer/signer indexes. I’ll add focused regression coverage for unauthorized callers while preserving the existing behavior for authorized issuers.

Please assign this to me, you won’t be disappointed, thank you.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Akintobidavid to this issue.

[OmniZlatoon]

@OmniZlatoon has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Sir please assign me your issues. I am desperate to work but issues are scarce. my Eta is 5 hours max.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @OmniZlatoon to this issue.

[drips-wave]

Congratulations, @Akintobidavid! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on August 31, 2026.

🧑‍💻 @Akintobidavid: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊