Skip to content

fix: wire config_freeze.rs into set_config() authorization path #3

Description

@Icahbod

Overview

config_freeze.rs implements freeze/unfreeze but these functions are never called from set_config(). The freeze flag has zero gating effect.

Evidence

File: apexchainx_calculator/src/config_freeze.rs — implements freeze logic
File: apexchainx_calculator/src/lib.rs — set_config() has no freeze check

Impact

  • Admin who calls freeze_config() has false sense of security
  • Config can still be changed despite freeze flag being set

Proposed Solution

Add require_not_frozen() check in set_config(). Expose freeze/unfreeze as admin-gated methods. Emit events.

Acceptance Criteria

  • set_config() returns error when config is frozen
  • Error uses clear variant (e.g., ConfigFrozen = 16)
  • Admin can freeze/unfreeze via contract methods
  • Freeze/unfreeze emit versioned events
  • is_config_frozen() returns correct state
  • Unfrozen state allows normal updates
  • All existing tests pass

File Map

  • apexchainx_calculator/src/config_freeze.rs
  • apexchainx_calculator/src/lib.rs
  • apexchainx_calculator/src/tests.rs

Testing Strategy

Unit: Freeze → attempt set_config → verify rejection. Unfreeze → verify success.

Labels: bug, high, security

Priority: High

Difficulty: Intermediate

Estimated Effort: 3h

Metadata

Metadata

Assignees

Labels

GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardOfficial CampaignCampaign: Official CampaignbugSomething isn't workinghighsecurity

Type

No type

Fields

No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions