fix: resolve security & audit issues (#265, #268, #266, #267)

[whiteghost0001]

Comprehensive multi-issue security hardening, economic caller-incentive update, and formal audit documentation.

1. Issue [High] Harden rescue_tokens' protected-token guard for forward-compatibility with multi-bond-token work #265 - Rescue Tokens Forward-Compatibility Audit

   • Updated rescue_tokens doc comments in intent_settlement/src/lib.rs with forward-compatibility audit notes for multi-bond-token design (Issue fix: check cumulative bond total against MIN_BOND, not each deposit #2 / docs/60-multi-bond-token-design.md).
   • Documented that BondToken is immutable post-initialization and noted requirements for updating rescue_tokens to query AllowedBondToken once multi-bond token schema ships.
   • Added explicit regression test test_rescue_tokens_refuses_bond_token in test.rs.

2. Issue [High] Analyze and address the caller-incentive gap for permissionless slash_solver/expire_intent #268 - Permissionless Caller Incentive Gap Analysis & Slash Solver Rebate

   • Conducted economic analysis in docs/268-caller-incentive-analysis.md for permissionless functions slash_solver and expire_intent.
   • Updated slash_solver in intent_settlement/src/lib.rs to carve out a 5% caller rebate (slash_amount / 20) for env.invoker() when slash_amount > 1, while preserving floor-of-1 non-zero slash guarantees. Total solver penalty remains 100% of slash_amount.
   • Added test test_slash_solver_caller_rebate in test.rs verifying caller payout, fee recipient balance, and solver bond deduction.

3. Issue [High] Audit dst_token allowlist removal against in-flight intents #266 - Destination Token Allowlist Removal In-Flight Audit

   • Authored formal audit docs/266-dst-token-removal-in-flight-audit.md confirming execute_remove_dst_token does not block in-flight Accepted / PartiallyFilled intents because fill_intent does not re-query is_dst_token_allowed.
   • Added regression tests test_remove_dst_token_in_flight_intent_fill and test_remove_dst_token_blocks_new_submissions in test.rs.

4. Issue [High] Formal collision/predictability audit of compute_intent_id's preimage #267 - Intent ID Preimage Collision & Predictability Audit

   • Authored formal audit docs/267-intent-id-collision-predictability-audit.md evaluating SHA-256 preimage (user, src_chain, amount, timestamp, nonce).
   • Demonstrated collision resistance and proved that griefing victim submissions via intentional hash collisions is impossible due to the victim user address parameter in the preimage.
   • Added unit test test_compute_intent_id_nonce_uniqueness in test.rs verifying nonce uniqueness across identical block timestamps.

Closes #265
Closes #268
Closes #266
Closes #267

Summary

Related issue

Type of change

• Bug fix
• New feature
• Refactor
• Documentation
• CI / tooling

Component

• Contract (vortex-contract)
• Backend (vortex-backend)
• Frontend (vortex-frontend)

Checklist

• My code follows the project's style and conventions
• I ran lint / type-check / build locally and they pass
• I added or updated tests where appropriate
• I updated documentation where appropriate
• My commits follow Conventional Commits

Screenshots / notes

[drips-wave]

@whiteghost0001 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits