From 962b29296d9608ca2f28ae7c4fb584599523b3e7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E9=B2=81=E7=8F=AD=E4=B8=83=E5=8F=B7?=
 <9159450+luban-71@user.noreply.gitee.com>
Date: Tue, 1 Sep 2026 11:54:02 +0800
Subject: [PATCH] fix(contract): real token transfer in deposit() (#55)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Import token::Client from soroban_sdk
- Add token::Client::transfer() call in deposit() to move real tokens
  from caller to contract before updating internal balance
- If transfer fails (insufficient balance, unauthorized), the entire
  transaction reverts — internal balance is never updated
- Removes placeholder comment about allowing any asset

Closes #55
---
 contracts/src/lib.rs | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/contracts/src/lib.rs b/contracts/src/lib.rs
index e3070c5..70d7fb0 100644
--- a/contracts/src/lib.rs
+++ b/contracts/src/lib.rs
@@ -1,5 +1,5 @@
 #![no_std]
-use soroban_sdk::{contract, contractimpl, Address, Env, Map};
+use soroban_sdk::{contract, contractimpl, token, Address, Env, Map};
 
 mod portfolio;
 mod reflector;
@@ -93,13 +93,12 @@ impl PortfolioRebalancer {
         
         portfolio.user.require_auth();
         
-        // Verify asset is in portfolio (optional based on requirements, but good practice)
-        if !portfolio.target_allocations.contains_key(asset.clone()) {
-             // For now, allow depositing any asset, as users might deposit first then rebalance
-             // or maybe we should restrict? The issue says "valid and invalid inputs". 
-             // Let's assume valid input means positive amount and valid asset.
-        }
 
+        // Transfer real tokens from caller to contract via Soroban token interface.
+        // Must happen before balance update - if transfer fails, transaction reverts.
+        let contract_address = env.current_contract_address();
+        let token_client = token::Client::new(&env, &asset);
+        token_client.transfer(&portfolio.user, &contract_address, &amount);
         let current_balance = portfolio.current_balances.get(asset.clone()).unwrap_or(0);
         portfolio.current_balances.set(asset.clone(), current_balance + amount);