Harden init to record the current schema version
Description
init in contracts/escrow/src/lib.rs stores only the admin and never writes DataKey::SchemaVersion. Because get_schema_version defaults to 1 when absent, a freshly deployed v2 contract reports schema version 1 and is therefore eligible for migrate_v1_to_v2 — a migration that is meaningless on a contract that was born at v2. This conflates "never migrated" with "freshly initialized at the current schema" and risks an unnecessary or confusing migration run. This issue makes init stamp the current schema version.
Requirements and context
- Repository scope:
Agentpay-Org/Agentpay-contracts only.
- In
init, write DataKey::SchemaVersion with the current code schema (matching version()'s intent — define a CURRENT_SCHEMA: u32 constant to avoid a magic number).
- Decide and document the interaction with
migrate_v1_to_v2: a contract that was init-ed at v2 must not be migratable (it should panic MigrationVersionMismatch), while a genuinely upgraded-from-v1 deployment still migrates.
- Keep
get_schema_version's unwrap_or(1) default for the legacy pre-existing deployments that never stamped a version.
- Ensure the change does not break the existing double-init guard.
Suggested execution
- Fork the repo and create a branch
git checkout -b security/contracts-init-stamps-schema-version- Implement changes
- Write code in:
contracts/escrow/src/lib.rs — stamp SchemaVersion in init; add the CURRENT_SCHEMA constant.
- Write comprehensive tests in:
contracts/escrow/src/test.rs — after init, get_schema_version returns the current version; migrate_v1_to_v2 on a freshly init-ed contract panics #11.
- Add documentation: clarify the init-vs-migrate distinction in
README.md.
- Include NatSpec-style doc comments (
///) matching the existing style in lib.rs.
- Validate security: no spurious migration on fresh deploys, legacy deployments unaffected.
- Test and commit
Test and commit
- Run
cargo fmt --all -- --check, cargo build, and cargo test.
- Cover edge cases: fresh init then migrate (rejected), legacy unset-version path still defaults to 1.
- Include the full
cargo test output and a short security notes section in the PR description.
Example commit message
security: stamp SchemaVersion at init to distinguish fresh v2 deploys
Guidelines
- Minimum 95 percent test coverage for impacted modules.
- Clear, reviewer-focused documentation.
- Timeframe: 96 hours.
Community & contribution rewards
- 💬 Join the AgentPay community on Discord for questions, reviews, and faster merges: https://discord.gg/eXvRKkgcv
- ⭐ This is a GrantFox OSS / Official Campaign task and may be rewarded. When your PR is merged you'll be prompted to rate the project — if this issue and the maintainers helped you ship, we'd be grateful for a 5-star rating. Clear questions in Discord and tidy, well-tested PRs are the fastest path to a merge and a reward.
Harden init to record the current schema version
Description
initincontracts/escrow/src/lib.rsstores only the admin and never writesDataKey::SchemaVersion. Becauseget_schema_versiondefaults to1when absent, a freshly deployed v2 contract reports schema version 1 and is therefore eligible formigrate_v1_to_v2— a migration that is meaningless on a contract that was born at v2. This conflates "never migrated" with "freshly initialized at the current schema" and risks an unnecessary or confusing migration run. This issue makesinitstamp the current schema version.Requirements and context
Agentpay-Org/Agentpay-contractsonly.init, writeDataKey::SchemaVersionwith the current code schema (matchingversion()'s intent — define aCURRENT_SCHEMA: u32constant to avoid a magic number).migrate_v1_to_v2: a contract that wasinit-ed at v2 must not be migratable (it should panicMigrationVersionMismatch), while a genuinely upgraded-from-v1 deployment still migrates.get_schema_version'sunwrap_or(1)default for the legacy pre-existing deployments that never stamped a version.Suggested execution
git checkout -b security/contracts-init-stamps-schema-versioncontracts/escrow/src/lib.rs— stampSchemaVersionininit; add theCURRENT_SCHEMAconstant.contracts/escrow/src/test.rs— afterinit,get_schema_versionreturns the current version;migrate_v1_to_v2on a freshly init-ed contract panics#11.README.md.///) matching the existing style inlib.rs.Test and commit
cargo fmt --all -- --check,cargo build, andcargo test.cargo testoutput and a short security notes section in the PR description.Example commit message
security: stamp SchemaVersion at init to distinguish fresh v2 deploysGuidelines
Community & contribution rewards