[peterjoshua482-netizen]

Admin-privileged functions (mint, burn, initialize) in contracts/token lacked explicit tests that verify an unauthorized caller receives TokenError::Unauthorized rather than silently succeeding.

Changes:

• contracts/token/src/lib.rs: add double-initialization guard to initialize; return TokenError::Unauthorized if the admin key is already present in storage (prevents admin-slot hijacking after first deployment).
• contracts/token/src/security_tests.rs: add unauthorized_call_tests module with 6 explicit tests:
  • test_mint_no_auth_fails
  • test_wrong_address_with_auth_cannot_mint
  • test_burn_no_auth_fails
  • test_wrong_address_with_auth_cannot_burn
  • test_double_initialize_by_admin_is_rejected
  • test_attacker_cannot_reinitialize_to_steal_admin

Closes #1318

Description

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update
• Dependency update
• CI/CD improvement

Related Issues

Closes #

Testing

• Unit tests added/updated
• Integration tests added/updated
• E2E tests added/updated (if applicable)
• Manual testing performed

Documentation

• README updated (if applicable)
• API documentation updated (if applicable)
• Code comments added for complex logic
• Migration guide added (if breaking changes)

Breaking Changes

• No breaking changes
• Breaking changes documented below:

Checklist

• My code follows the project's style guidelines
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests passed locally with my changes
• Any dependent changes have been merged and published

Screenshots (if applicable)

Additional Context