Skip to content

Revenue pool: deduplicate recipients in batch_distribute and validate against accidental double-pay #348

@greatest0fallt1me

Description

@greatest0fallt1me

Description

RevenuePool::batch_distribute (contracts/revenue_pool/src/lib.rs) sums and transfers each (Address, i128) leg but never checks for duplicate recipients within the same batch. A malformed off-chain payload listing the same developer twice silently double-pays. Add optional duplicate detection and clear semantics.

Requirements and Context

  • Detect duplicate to addresses within a single payments vector and either reject or document/merge per agreed policy.
  • Keep the existing total-then-transfer atomicity and MAX_BATCH_SIZE cap.
  • Emit events reflecting the final per-recipient amount.
  • Must be secure, tested, and documented
  • Should be efficient and easy to review

Suggested Execution

  1. Fork the repo and create a branch
    git checkout -b feature/revenue-pool-dedup-recipients
  2. Implement changes
    • contracts/revenue_pool/src/lib.rs — duplicate handling in batch_distribute
    • contracts/revenue_pool/BATCH_TRANSFER_IMPLEMENTATION.md — document policy
  3. Test and commit
    • cargo test -p callora-revenue-pool
    • Test duplicate-recipient batches behave per policy
    • Include test output and notes in the PR

Example commit message

feat: handle duplicate recipients in revenue pool batch_distribute

Acceptance Criteria

  • Duplicate recipients detected and handled per documented policy
  • Atomicity and batch cap preserved
  • Events reflect final amounts
  • Tests cover duplicate cases

Guidelines

  • .rs under contracts/revenue_pool/src/, cargo test, /// docs, minimum 95% line coverage, no unwrap() in prod paths
  • Clear documentation and inline comments
  • Timeframe: 96 hours

Metadata

Metadata

Labels

Stellar WaveIssues in the Stellar wave programsecuritySecurity hardeningsmart-contractSoroban smart-contract worksorobanSoroban SDK / Stellar
No fields configured for Feature.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions