Issues

`get_network_health`-equivalent / RPC endpoint config — confirm `src/config/networks.rs`'s hardcoded RPC/Horizon URLs have a fallback or health check, given this exact class of staleness already caused a cross-repo bug this cycle

Bonizozo/stellar-tipjar-contracts#423 · opened

on Aug 15, 2026

4

`TipVerifyRequest`-equivalent on the contract side — confirm `tip()`'s `sender` parameter can't be spoofed relative to the actual transaction signer in a way the backend's off-chain verification (which trusts `source_account`) wouldn't catch

Bonizozo/stellar-tipjar-contracts#422 · opened

on Aug 15, 2026

2

`tests/integration/tip_flow_test.rs` — confirm the `tests/integration` workspace member (a genuinely wired-up package, unlike the root tree) actually exercises the real `contracts/tipjar` end-to-end, including multi-token and fee paths

Bonizozo/stellar-tipjar-contracts#420 · opened

on Aug 15, 2026

2

Confirm `security.yml`/`contract-ci.yml` would catch an entire package silently dropping out of the workspace build graph (the root `src`/`tests` tree's failure mode found in this audit)

Bonizozo/stellar-tipjar-contracts#418 · opened

on Aug 15, 2026

2

`Error` enum numeric discriminants — confirm append-only, never-renumbered discipline for external consumers that pattern-match on the raw code

Bonizozo/stellar-tipjar-contracts#416 · opened

on Aug 15, 2026

2

`deploy.yml`/`deploy-testnet.yml` — confirm the deployment pipeline verifies the deployed WASM hash matches what was actually reviewed/merged, not just "whatever `cargo build` produces at deploy time"

Bonizozo/stellar-tipjar-contracts#412 · opened

on Aug 15, 2026

3

`examples/simulate_tip.rs` — confirm it stays runnable/current as a smoke test, not stale example code that silently bit-rots

Bonizozo/stellar-tipjar-contracts#410 · opened

on Aug 15, 2026

2

`ttl_tests.rs` — confirm TTL/archival recovery is tested for every persistent key type, not just the ones exercised by the original feature PR that introduced this test file

Bonizozo/stellar-tipjar-contracts#409 · opened

on Aug 15, 2026

2

`contracts/tipjar/src/test_multitoken.rs` — confirm cross-token isolation is explicitly tested (a bug in one token's accounting shouldn't be able to affect another's)

Bonizozo/stellar-tipjar-contracts#408 · opened

on Aug 15, 2026

4

`MuxedAddress::from(payout_address)` in `withdraw`/`withdraw_fees` — confirm muxed-account semantics are handled correctly for payout addresses that are themselves already muxed

Bonizozo/stellar-tipjar-contracts#405 · opened

on Aug 15, 2026

2

`Cargo.toml`'s `[profile.release]` (`opt-level = "z"`, `lto = true`, `panic = "abort"`) — confirm `panic = "abort"` is compatible with Soroban's error-handling model across every crate in this large workspace, not just the tip jar contract

Bonizozo/stellar-tipjar-contracts#404 · opened

on Aug 15, 2026

2

`test_invariants.rs`/`quickcheck_properties.rs` — confirm property-based tests cover the fee-accounting invariant broken elsewhere in this audit (global `FeeBalance` vs. per-token balances)

Bonizozo/stellar-tipjar-contracts#403 · opened

on Aug 15, 2026

2

`Vec<Address>`-backed `AllowedTokens` — confirm `add_token` correctly rejects a duplicate address rather than allowing the same token to appear twice and silently doubling the linear-scan cost

Bonizozo/stellar-tipjar-contracts#402 · opened

on Aug 15, 2026

2

`panic_with_error!` mid-function — audit for any entrypoint where a panic after partial storage mutation could leave inconsistent state

Bonizozo/stellar-tipjar-contracts#401 · opened

on Aug 15, 2026

2

`soroban-sdk = "22.0.0"` — audit for known advisories/CVEs at this specific pinned version and establish an update cadence

Bonizozo/stellar-tipjar-contracts#400 · opened

on Aug 15, 2026

2

`tools/doc-generator` — confirm generated documentation is actually published somewhere, not orphaned tooling

Bonizozo/stellar-tipjar-contracts#399 · opened

on Aug 15, 2026

2

`src/config/{contracts,networks}.rs` — confirm deployed contract addresses aren't hardcoded and stale for testnet after redeployment

Bonizozo/stellar-tipjar-contracts#398 · opened

on Aug 15, 2026

2

`analytics/` crate — confirm it ingests real on-chain event data via `indexer`, not synthetic/stub data

Bonizozo/stellar-tipjar-contracts#397 · opened

on Aug 15, 2026

2

`scripts/migrate/*` (export/import/transform/verify state) — a second, off-chain state-migration mechanism alongside the contract's own on-chain `migrate()` — clarify when each is used

Bonizozo/stellar-tipjar-contracts#396 · opened

on Aug 15, 2026

2

`tools/backup` (state exporter/importer) — confirm exported on-chain state snapshots are encrypted/access-controlled, not just checksummed

Bonizozo/stellar-tipjar-contracts#395 · opened

on Aug 15, 2026

2

`tools/gas-estimator` and `tools/gas/{gas_analyzer,gas_profiler}.rs` — two separate gas-analysis tools; confirm they're not redundant or (worse) reporting inconsistent numbers

Bonizozo/stellar-tipjar-contracts#394 · opened

on Aug 15, 2026

2

`security/` crate (anomaly detector, circuit breaker, rate limiter, alerting) — confirm it's actually wired to production monitoring, not a standalone/unused module

Bonizozo/stellar-tipjar-contracts#393 · opened

on Aug 15, 2026

2

`simulator` crate — confirm its cost/resource modeling stays accurate against real Soroban network fee-computation changes

Bonizozo/stellar-tipjar-contracts#392 · opened

on Aug 15, 2026

1

`contract-ci.yml`, `test.yml`, and `security.yml` — audit for redundant or conflicting CI coverage across three separate workflow files

Bonizozo/stellar-tipjar-contracts#389 · opened

on Aug 15, 2026

1

`contracts/tipjar-v2-fixture` hand-mirrors the real contract's storage keys with no automated drift check — it already drifted silently once this session

Bonizozo/stellar-tipjar-contracts#387 · opened

on Aug 15, 2026

2

Navigation Menu

Repository navigation

Issues

`get_network_health`-equivalent / RPC endpoint config — confirm `src/config/networks.rs`'s hardcoded RPC/Horizon URLs have a fallback or health check, given this exact class of staleness already caused a cross-repo bug this cycle

`TipVerifyRequest`-equivalent on the contract side — confirm `tip()`'s `sender` parameter can't be spoofed relative to the actual transaction signer in a way the backend's off-chain verification (which trusts `source_account`) wouldn't catch

`tests/integration/tip_flow_test.rs` — confirm the `tests/integration` workspace member (a genuinely wired-up package, unlike the root tree) actually exercises the real `contracts/tipjar` end-to-end, including multi-token and fee paths

Confirm `security.yml`/`contract-ci.yml` would catch an entire package silently dropping out of the workspace build graph (the root `src`/`tests` tree's failure mode found in this audit)

`Error` enum numeric discriminants — confirm append-only, never-renumbered discipline for external consumers that pattern-match on the raw code

`deploy.yml`/`deploy-testnet.yml` — confirm the deployment pipeline verifies the deployed WASM hash matches what was actually reviewed/merged, not just "whatever `cargo build` produces at deploy time"

`examples/simulate_tip.rs` — confirm it stays runnable/current as a smoke test, not stale example code that silently bit-rots

`ttl_tests.rs` — confirm TTL/archival recovery is tested for every persistent key type, not just the ones exercised by the original feature PR that introduced this test file

`contracts/tipjar/src/test_multitoken.rs` — confirm cross-token isolation is explicitly tested (a bug in one token's accounting shouldn't be able to affect another's)

`MuxedAddress::from(payout_address)` in `withdraw`/`withdraw_fees` — confirm muxed-account semantics are handled correctly for payout addresses that are themselves already muxed

`Cargo.toml`'s `[profile.release]` (`opt-level = "z"`, `lto = true`, `panic = "abort"`) — confirm `panic = "abort"` is compatible with Soroban's error-handling model across every crate in this large workspace, not just the tip jar contract

`test_invariants.rs`/`quickcheck_properties.rs` — confirm property-based tests cover the fee-accounting invariant broken elsewhere in this audit (global `FeeBalance` vs. per-token balances)

`Vec<Address>`-backed `AllowedTokens` — confirm `add_token` correctly rejects a duplicate address rather than allowing the same token to appear twice and silently doubling the linear-scan cost

`panic_with_error!` mid-function — audit for any entrypoint where a panic after partial storage mutation could leave inconsistent state

`soroban-sdk = "22.0.0"` — audit for known advisories/CVEs at this specific pinned version and establish an update cadence

`tools/doc-generator` — confirm generated documentation is actually published somewhere, not orphaned tooling

`src/config/{contracts,networks}.rs` — confirm deployed contract addresses aren't hardcoded and stale for testnet after redeployment

`analytics/` crate — confirm it ingests real on-chain event data via `indexer`, not synthetic/stub data

`scripts/migrate/*` (export/import/transform/verify state) — a second, off-chain state-migration mechanism alongside the contract's own on-chain `migrate()` — clarify when each is used

`tools/backup` (state exporter/importer) — confirm exported on-chain state snapshots are encrypted/access-controlled, not just checksummed

`tools/gas-estimator` and `tools/gas/{gas_analyzer,gas_profiler}.rs` — two separate gas-analysis tools; confirm they're not redundant or (worse) reporting inconsistent numbers

`security/` crate (anomaly detector, circuit breaker, rate limiter, alerting) — confirm it's actually wired to production monitoring, not a standalone/unused module

`simulator` crate — confirm its cost/resource modeling stays accurate against real Soroban network fee-computation changes

`contract-ci.yml`, `test.yml`, and `security.yml` — audit for redundant or conflicting CI coverage across three separate workflow files

`contracts/tipjar-v2-fixture` hand-mirrors the real contract's storage keys with no automated drift check — it already drifted silently once this session