Issues

`marketplace::claim_refund` moves tokens out of `financing_pool`'s balance via a direct `token.transfer(from=financing_pool, ...)` call that would fail real Soroban authorization outside of `mock_all_auths()`

#524

· OxDev-max opened

on Jul 25, 2026

SDK's `InvoiceNftClient` has no binding for `mint_invoices_batch`, `set_listed`, `set_funded`, `set_repaid`, or `set_defaulted` — the SDK cannot drive the batch-minting or status-transition flows the contract actually exposes

#523

· OxDev-max opened

on Jul 25, 2026

`.github/workflows/release.yml` is still a do-nothing stub despite closed issue #254 claiming release tagging tied to WASM hashes was implemented

#522

· OxDev-max opened

on Jul 25, 2026

`financing_pool.mark_default`'s best-effort `risk_registry.try_record_default()` call silently swallows failures with no event or observability path

#521

· OxDev-max opened

on Jul 25, 2026

SDK has no error-decoding layer mapping raw simulation/transaction failures to the `KoraError` enum

#520

· OxDev-max opened

on Jul 25, 2026

SDK clients expose no `initialize()` bindings and `PriceOracleClient`/`RiskRegistryClient.addVerifier` are stale relative to the deployed contracts' real interfaces

#517

· OxDev-max opened

on Jul 25, 2026

The `sdk/` TypeScript package has zero automated test coverage and is completely absent from CI

#516

· OxDev-max opened

on Jul 25, 2026

Numerous `#[test]` functions in `financing_pool_edge_cases.rs` and `access_control_edge_cases.rs` contain no contract calls or assertions, creating false coverage signal

#515

· OxDev-max opened

on Jul 25, 2026

`scripts/interact.sh`'s `kora_add_verifier` (and the `demo.sh` reference flow) calls the pre-staking 2-argument `risk_registry.add_verifier` instead of the required `(admin, verifier, stake_amount)` signature

#514

· OxDev-max opened

on Jul 25, 2026

`price_oracle` is systematically omitted from build/release/monitoring tooling (`Makefile`, `wasm-size.yml`, `record-wasm-hashes.sh`, `health-check.sh`)

#513

· OxDev-max opened

on Jul 25, 2026

`scripts/deploy.sh` deploys `risk_registry` twice and calls `risk_registry`/`marketplace`/`price_oracle` `initialize()` with argument lists that don't match their current signatures

#512

· OxDev-max opened

on Jul 25, 2026

`scripts/deploy.sh` never calls `invoice_nft.set_authorized_callers` — every fresh deployment leaves `marketplace`/`financing_pool` unauthorized to transition invoice status

#511

· OxDev-max opened

on Jul 25, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

All issues

`marketplace::claim_refund` moves tokens out of `financing_pool`'s balance via a direct `token.transfer(from=financing_pool, ...)` call that would fail real Soroban authorization outside of `mock_all_auths()`

SDK's `InvoiceNftClient` has no binding for `mint_invoices_batch`, `set_listed`, `set_funded`, `set_repaid`, or `set_defaulted` — the SDK cannot drive the batch-minting or status-transition flows the contract actually exposes

`.github/workflows/release.yml` is still a do-nothing stub despite closed issue #254 claiming release tagging tied to WASM hashes was implemented

`financing_pool.mark_default`'s best-effort `risk_registry.try_record_default()` call silently swallows failures with no event or observability path

SDK has no error-decoding layer mapping raw simulation/transaction failures to the `KoraError` enum

SDK clients expose no `initialize()` bindings and `PriceOracleClient`/`RiskRegistryClient.addVerifier` are stale relative to the deployed contracts' real interfaces

The `sdk/` TypeScript package has zero automated test coverage and is completely absent from CI

Numerous `#[test]` functions in `financing_pool_edge_cases.rs` and `access_control_edge_cases.rs` contain no contract calls or assertions, creating false coverage signal

`scripts/interact.sh`'s `kora_add_verifier` (and the `demo.sh` reference flow) calls the pre-staking 2-argument `risk_registry.add_verifier` instead of the required `(admin, verifier, stake_amount)` signature

`price_oracle` is systematically omitted from build/release/monitoring tooling (`Makefile`, `wasm-size.yml`, `record-wasm-hashes.sh`, `health-check.sh`)

`scripts/deploy.sh` deploys `risk_registry` twice and calls `risk_registry`/`marketplace`/`price_oracle` `initialize()` with argument lists that don't match their current signatures

`scripts/deploy.sh` never calls `invoice_nft.set_authorized_callers` — every fresh deployment leaves `marketplace`/`financing_pool` unauthorized to transition invoice status

Uh oh!

Search results