-
Notifications
You must be signed in to change notification settings - Fork 17
All issues
Issue creation is restricted in this repository
Issues
is:issue state:open
is:issue state:open
Search results
token_bridge: per-holder WBAL entries never TTL-extended — a dormant wrapped-token balance risks archival and traps on read
bugSomething isn't workingSomething isn't workingcontractsSmart contract logicSmart contract logicGrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardIssue may be eligible for a GrantFox rewardOfficial Campaign | FWC26Campaign: Official Campaign | FWC26Campaign: Official Campaign | FWC26Third CampaignCampaign: Third CampaignCampaign: Third Campaignvery hardVery difficult / senior-level bounty issueVery difficult / senior-level bounty issueStatus: Open.#55 In StellarSend/contracts;PaymentRecord's sequence counter is global, not per-sender, making the (from, seq) storage key non-contiguous despite its shape implying otherwise
bugSomething isn't workingSomething isn't workingcontractsSmart contract logicSmart contract logicdocumentationImprovements or additions to documentationImprovements or additions to documentationGrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardIssue may be eligible for a GrantFox rewardOfficial Campaign | FWC26Campaign: Official Campaign | FWC26Campaign: Official Campaign | FWC26Third CampaignCampaign: Third CampaignCampaign: Third Campaignvery hardVery difficult / senior-level bounty issueVery difficult / senior-level bounty issueStatus: Open.#52 In StellarSend/contracts;No test across any of the four contracts simulates Soroban persistent-storage TTL expiry
contractsSmart contract logicSmart contract logicGrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardIssue may be eligible for a GrantFox rewardOfficial Campaign | FWC26Campaign: Official Campaign | FWC26Campaign: Official Campaign | FWC26testingTest coverage relatedTest coverage relatedThird CampaignCampaign: Third CampaignCampaign: Third Campaignvery hardVery difficult / senior-level bounty issueVery difficult / senior-level bounty issueStatus: Open.#51 In StellarSend/contracts;send_payment and create_payment_request accept unbounded memo strings despite a doc comment recommending a 28-byte maximum
bugSomething isn't workingSomething isn't workingcontractsSmart contract logicSmart contract logicGrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardIssue may be eligible for a GrantFox rewardOfficial Campaign | FWC26Campaign: Official Campaign | FWC26Campaign: Official Campaign | FWC26Third CampaignCampaign: Third CampaignCampaign: Third Campaignvery hardVery difficult / senior-level bounty issueVery difficult / senior-level bounty issueStatus: Open.#49 In StellarSend/contracts;StellarSendError::InvalidFeeCollector is dead code — initialize() never validates the fee_collector address
bugSomething isn't workingSomething isn't workingcontractsSmart contract logicSmart contract logicGrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardIssue may be eligible for a GrantFox rewardOfficial Campaign | FWC26Campaign: Official Campaign | FWC26Campaign: Official Campaign | FWC26Third CampaignCampaign: Third CampaignCampaign: Third Campaignvery hardVery difficult / senior-level bounty issueVery difficult / senior-level bounty issueStatus: Open.#47 In StellarSend/contracts;execute_subscription reads fee_bps fresh from global config every execution — admin fee changes retroactively alter live subscriptions without payer re-consent
bugSomething isn't workingSomething isn't workingcontractsSmart contract logicSmart contract logicGrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardIssue may be eligible for a GrantFox rewardOfficial Campaign | FWC26Campaign: Official Campaign | FWC26Campaign: Official Campaign | FWC26securitySecurity concernSecurity concernThird CampaignCampaign: Third CampaignCampaign: Third Campaignvery hardVery difficult / senior-level bounty issueVery difficult / senior-level bounty issueStatus: Open.#46 In StellarSend/contracts;stellar_send: persistent Subscription records are never TTL-extended, risking archival for exactly the long-interval payments the feature exists to serve
bugSomething isn't workingSomething isn't workingcontractsSmart contract logicSmart contract logicGrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardIssue may be eligible for a GrantFox rewardOfficial Campaign | FWC26Campaign: Official Campaign | FWC26Campaign: Official Campaign | FWC26Third CampaignCampaign: Third CampaignCampaign: Third Campaignvery hardVery difficult / senior-level bounty issueVery difficult / senior-level bounty issueStatus: Open.#43 In StellarSend/contracts;fee_collector::collect_fee's obvious access-control fix would break its real caller — no allowlist primitive exists anywhere
contractsSmart contract logicSmart contract logicGrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardIssue may be eligible for a GrantFox rewardOfficial Campaign | FWC26Campaign: Official Campaign | FWC26Campaign: Official Campaign | FWC26securitySecurity concernSecurity concernspikeOpen-ended research/design investigation, not a fixed-scope fixOpen-ended research/design investigation, not a fixed-scope fixThird CampaignCampaign: Third CampaignCampaign: Third Campaignvery hardVery difficult / senior-level bounty issueVery difficult / senior-level bounty issueStatus: Open.#42 In StellarSend/contracts;fee_collector::collect_fee has no reconciliation between claimed amounts and actual balance, and no invariant-check function exists
contractsSmart contract logicSmart contract logicenhancementNew feature or requestNew feature or requestGrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardIssue may be eligible for a GrantFox rewardOfficial Campaign | FWC26Campaign: Official Campaign | FWC26Campaign: Official Campaign | FWC26Third CampaignCampaign: Third CampaignCampaign: Third Campaignvery hardVery difficult / senior-level bounty issueVery difficult / senior-level bounty issueStatus: Open.#41 In StellarSend/contracts;fee_collector has no way to rotate or recover the admin address — a lost key permanently locks withdraw and set_treasury
bugSomething isn't workingSomething isn't workingcontractsSmart contract logicSmart contract logicGrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardIssue may be eligible for a GrantFox rewardOfficial Campaign | FWC26Campaign: Official Campaign | FWC26Campaign: Official Campaign | FWC26securitySecurity concernSecurity concernThird CampaignCampaign: Third CampaignCampaign: Third Campaignvery hardVery difficult / senior-level bounty issueVery difficult / senior-level bounty issueStatus: Open.#40 In StellarSend/contracts;fee_collector: persistent per-token totals are never TTL-extended, and get_total_collected silently masks archival as zero
bugSomething isn't workingSomething isn't workingcontractsSmart contract logicSmart contract logicGrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardIssue may be eligible for a GrantFox rewardOfficial Campaign | FWC26Campaign: Official Campaign | FWC26Campaign: Official Campaign | FWC26Third CampaignCampaign: Third CampaignCampaign: Third Campaignvery hardVery difficult / senior-level bounty issueVery difficult / senior-level bounty issueStatus: Open.#39 In StellarSend/contracts;escrow::create_escrow lets beneficiary be set to a contract address that can never authorize its own claim
bugSomething isn't workingSomething isn't workingcontractsSmart contract logicSmart contract logicdocumentationImprovements or additions to documentationImprovements or additions to documentationGrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardIssue may be eligible for a GrantFox rewardOfficial Campaign | FWC26Campaign: Official Campaign | FWC26Campaign: Official Campaign | FWC26Third CampaignCampaign: Third CampaignCampaign: Third Campaignvery hardVery difficult / senior-level bounty issueVery difficult / senior-level bounty issueStatus: Open.#38 In StellarSend/contracts;