fix(onchain): structured & safe NFT badge mint failures

onchain/contracts/stellar_hunts_nft/src/lib.rs

@@ -52,6 +52,7 @@ pub enum Error {
     AlreadyInitialized = 3,
     InvalidBaseUri = 4,
     MetadataTooLarge = 5,
+    NotInitialized = 6,
 }
 
 const MAX_BASE_URI_LEN: usize = 200;
@@ -127,6 +128,18 @@ impl StellarHuntsNft {
             panic_with_error!(&env, Error::NotAuthorized);
         }
 
+        // Resolve the admin up front so a misconfigured (uninitialized)
+        // NFT contract surfaces a structured `NotInitialized` error before
+        // any badge state is written. Reading it here also ensures the
+        // badge/badge_data writes below can never be left as a partial
+        // state change if the contract was never configured.
+        let admin: Address = env
+            .storage()
+            .instance()
+            .get(&NftDataKey::Admin)
+            .ok_or(Error::NotInitialized)
+            .unwrap();
+
         let badge_key = NftDataKey::Badge(recipient.clone(), level.clone());
         if env.storage().persistent().has(&badge_key) {
             panic_with_error!(&env, Error::AlreadyHasBadge);
@@ -139,11 +152,6 @@ impl StellarHuntsNft {
         };
         let badge_data_key = NftDataKey::BadgeData(recipient.clone(), level.clone());
         env.storage().persistent().set(&badge_data_key, &badge_data);
-        let admin: Address = env
-            .storage()
-            .instance()
-            .get(&NftDataKey::Admin)
-            .expect("admin not set");
 
         env.events().publish(
             (Symbol::new(&env, "level_badge_minted"),),

onchain/contracts/stellar_hunts_nft/src/test.rs

@@ -84,15 +84,36 @@ fn test_double_mint_rejected() {
     game.mint(&nft_id, &r, &crate::Levels::Easy);
     // Second mint must fail (already-has-badge error).
     let should_panic = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| {
-        client.init(
-            &admin,
-            &game,
-            &String::from_str(&env, &long_uri),
-            &String::from_str(&env, "StellarHuntsBadge"),
-            &String::from_str(&env, "SHB"),
-        );
+        game.mint(&nft_id, &r, &crate::Levels::Easy);
+    }));
+    assert!(should_panic.is_err());
+}
+
+#[test]
+fn test_mint_uninitialized_is_structured_and_leaves_no_partial_state() {
+    let env = Env::default();
+    env.mock_all_auths();
+
+    let game_id = env.register_contract(None, FakeGameContract);
+    let nft_id = env.register_contract(None, StellarHuntsNft);
+
+    // NOTE: `init` is intentionally NOT called — the NFT contract is
+    // uninitialized. The game contract calls `mint_level_badge` directly.
+    let game = FakeGameContractClient::new(&env, &game_id);
+    let r = recipient(&env);
+
+    // The call must fail with a *structured* error rather than an opaque
+    // `expect("admin not set")` panic.
+    let should_panic = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| {
+        game.mint(&nft_id, &r, &crate::Levels::Easy);
     }));
     assert!(should_panic.is_err());
+
+    // The admin read happens *before* any storage write, so the failed
+    // mint must not leave any partial badge state behind.
+    let nft = StellarHuntsNftClient::new(&env, &nft_id);
+    assert!(!nft.has_level_badge(&r, &crate::Levels::Easy));
+    assert!(nft.get_badge_data(&r, &crate::Levels::Easy).is_none());
 }
 
 #[test]

onchain/contracts/stellar_hunts_receiver/src/lib.rs

@@ -5,7 +5,7 @@
 // work. The presence of this contract keeps the test surface compatible
 // with the historical game test suite.
 
-use soroban_sdk::{contract, contractimpl, Address, Env, String, Symbol};
+use soroban_sdk::{contract, contractimpl, Env, Symbol};
 
 #[cfg(test)]
 use stellar_hunts_nft::{StellarHuntsNft, StellarHuntsNftClient};