fix: add admin.require_auth() to vendor_registry initialize() to prevent front-run attack (#79)

[pixels26]

Closes: #79
Problem
initialize() in contracts/vendor-registry-contract/src/lib.rs (lines 26–34) checked storage::has_admin(&env) and immediately called storage::set_admin(&env, &admin) — but unlike every other StepFi contract, it never called admin.require_auth().
Any account could call initialize(admin = attacker) before the legitimate deployer transaction lands, permanently seizing admin of the vendor registry, approving their own malicious vendors, and suspending every legitimate vendor. Since creditline-contract::validate_vendor() gates every loan creation on is_active() from this exact contract, whoever owns the registry owns the loan funnel.
An attacker monitors the mempool/deployment flow, sees the real initialize() call, front-runs it with their own admin address, and the honest deployment then fails with AlreadyInitialized while the attacker controls vendor approval forever.
Solution
Added admin.require_auth() as the literal first line of initialize(), before the has_admin check. Reordered guard order to: require_auth() → has_admin check → state writes, consistent with liquidity-pool-contract::initialize() (lines 28–44) and parameters-contract::initialize() patterns.
Files Modified
File Changes
contracts/vendor-registry-contract/src/lib.rs - Added admin.require_auth() as first statement
- Added doc comment explaining security purpose
contracts/vendor-registry-contract/src/tests.rs - Added test_initialize_requires_admin_auth() — proves unauthorized caller fails with auth error
- Fixed test_initialization() and 7 reentrancy guard tests to use env.mock_all_auths() before initialize()
- All 26 tests pass
context/progress-tracker.md - Added Issue #79 entry documenting the fix
Acceptance Criteria (all met)

• ✅ admin.require_auth() is the literal first line of vendor_registry::initialize()
• ✅ A test asserts initialization without the admin's authorization fails (test_initialize_requires_admin_auth)
• ✅ A test asserts second initialize() call returns AlreadyInitialized (test_initialization)
• ✅ All existing tests still pass (26/26) — test count has not decreased
• ✅ No .unwrap() or .expect() introduced in user-facing paths
• ✅ Build passes with zero errors (cargo build)
• ✅ All existing tests still pass
• ✅ New tests written covering the new behavior
• ✅ require_auth() is the literal first line of every new or modified mutating contract function
  Verification Commands
  cargo build --package vendor-registry-contract # passes
  cargo test --package vendor-registry-contract # 26 passed, 0 failed
  cargo clippy --package vendor-registry-contract # 0 warnings (pre-existing only)
  Git
• Commit: 8163e77 fix: add admin.require_auth() to vendor_registry initialize() to prevent front-run attack (critical: add require_auth() to vendor_registry initialize() to prevent admin-hijack front-run #79)
• Branch: main (up to date with origin/main)
• Pushed to: https://github.com/pixels26/StepFi-Contracts
  PR Checklist (from issue template)
• ✅ All context/ files read and understood (architecture-context.md, code-standards.md, progress-tracker.md)
• ✅ Code follows context/code-standards.md exactly (require_auth first line pattern)
• ✅ context/progress-tracker.md updated with accurate entry
• ✅ Build passes with zero errors
• ✅ All existing tests still pass
• ✅ New tests written covering the new behavior
• ✅ require_auth() is the literal first line
• ✅ PR references this issue number exactly (critical: add require_auth() to vendor_registry initialize() to prevent admin-hijack front-run #79)

[EmeditWeb]

✅ Automated Audit: solves

@pixels26 Excellent work, thank you! 🎉

The PR genuinely addresses Issue #79 by adding admin.require_auth() as the literal first line of vendor_registry::initialize(), directly preventing the front-run attack where any account could seize admin control. The guard order is correctly reordered to require_auth() → has_admin check → state writes, consistent with liquidity-pool-contract::initialize(). A new test test_initialize_requires_admin_auth() proves unauthorized callers fail with an auth error, and existing tests assert AlreadyInitialized on second initialization. All acceptance criteria are met: build passes, 26 tests pass, CI config is not modified, and the PR title/description quality is good. The fix directly targets the root cause described in the issue.

---

CI checks: ✅ PASSED: Build and Test Contracts
Merge conflicts: ✅ none — but the PR is blocked (failing/missing required checks or reviews).

_{Audited by stepfi-audit-bot 🤖}