fix(settlement): checked arithmetic for credited balances

README.md

@@ -1,4 +1,4 @@
-# Callora Contracts
+# Callora Contracts 
 
 Soroban smart contracts for the Callora API marketplace: prepaid vault (USDC) and balance deduction for pay-per-call settlement.
 

contracts/revenue_pool/src/test.rs

@@ -177,6 +177,37 @@ fn set_admin_two_step_transfers_control() {
     assert_eq!(usdc_client.balance(&developer), 100);
 }
 
+#[test]
+#[should_panic(expected = "unauthorized: caller is not admin")]
+fn set_admin_unauthorized_panics() {
+    let env = Env::default();
+    env.mock_all_auths();
+    let admin = Address::generate(&env);
+    let attacker = Address::generate(&env);
+    let new_admin = Address::generate(&env);
+    let (_, client) = create_pool(&env);
+    let (usdc, _, _) = create_usdc(&env, &admin);
+
+    client.init(&admin, &usdc);
+    client.set_admin(&attacker, &new_admin);
+}
+
+#[test]
+#[should_panic(expected = "unauthorized: caller is not pending admin")]
+fn claim_admin_wrong_address_panics() {
+    let env = Env::default();
+    env.mock_all_auths();
+    let admin = Address::generate(&env);
+    let new_admin = Address::generate(&env);
+    let attacker = Address::generate(&env);
+    let (_, client) = create_pool(&env);
+    let (usdc, _, _) = create_usdc(&env, &admin);
+
+    client.init(&admin, &usdc);
+    client.set_admin(&admin, &new_admin);
+    client.claim_admin(&attacker);
+}
+
 #[test]
 fn admin_transfer_emits_events() {
     let env = Env::default();
@@ -211,6 +242,27 @@ fn admin_transfer_emits_events() {
     );
 }
 
+#[test]
+fn receive_payment_emits_event() {
+    let env = Env::default();
+    env.mock_all_auths();
+    let admin = Address::generate(&env);
+    let (_, client) = create_pool(&env);
+    let (usdc, _, _) = create_usdc(&env, &admin);
+
+    client.init(&admin, &usdc);
+    client.receive_payment(&admin, &250, &true);
+
+    let events = env.events().all();
+    let receive_payment_event = events.last().unwrap();
+    let event_name = Symbol::try_from_val(&env, &receive_payment_event.1.get(0).unwrap()).unwrap();
+    assert_eq!(event_name, Symbol::new(&env, "receive_payment"));
+
+    let amount_and_source: (i128, bool) =
+        <(i128, bool)>::try_from_val(&env, &receive_payment_event.2).unwrap();
+    assert_eq!(amount_and_source, (250, true));
+}
+
 #[test]
 fn batch_distribute_success() {
     let env = Env::default();

contracts/settlement/Cargo.toml

@@ -2,15 +2,17 @@
 name = "callora-settlement"
 version = "0.1.0"
 edition = "2021"
+publish = false
 
 [lib]
-crate-type = ["cdylib", "lib"]
+crate-type = ["cdylib", "rlib"]
+doctest = false
 
 [dependencies]
-soroban-sdk = "22.0.0"
+soroban-sdk = { workspace = true }
 
 [dev-dependencies]
-soroban-sdk = { version = "22.0.0", features = ["testutils"] }
+soroban-sdk = { workspace = true, features = ["testutils"] }
 
 [features]
 testutils = ["soroban-sdk/testutils"]

contracts/settlement/src/test.rs

@@ -13,7 +13,8 @@ mod settlement_tests {
         env.mock_all_auths();
         let admin = Address::generate(&env);
         let vault = Address::generate(&env);
-                let addr = env.register(CalloraSettlement, ());
+        let third_party = Address::generate(&env);
+        let addr = env.register(CalloraSettlement, ());
         let client = CalloraSettlementClient::new(&env, &addr);
         client.init(&admin, &vault);
         (env, addr, admin, vault, third_party)
@@ -152,7 +153,7 @@ mod settlement_tests {
         env.mock_all_auths();
         let admin = Address::generate(&env);
         let vault = Address::generate(&env);
-                let addr = env.register(CalloraSettlement, ());
+        let addr = env.register(CalloraSettlement, ());
         let client = CalloraSettlementClient::new(&env, &addr);
         client.init(&admin, &vault);
         client.receive_payment(&admin, &100i128, &true, &None);

contracts/vault/src/lib.rs

@@ -325,7 +325,10 @@ impl CalloraVault {
         if let Some(s) = inst.get::<StorageKey, Address>(&StorageKey::Settlement) {
             let ut: Address = inst.get(&StorageKey::UsdcToken).unwrap();
             Self::transfer_funds(&env, &ut, &s, amount);
-        } else if inst.get::<StorageKey, Address>(&StorageKey::RevenuePool).is_some() {
+        } else if inst
+            .get::<StorageKey, Address>(&StorageKey::RevenuePool)
+            .is_some()
+        {
             Self::transfer_to_revenue_pool(env.clone(), amount);
         }
         let rid = request_id.unwrap_or(Symbol::new(&env, ""));
@@ -372,7 +375,10 @@ impl CalloraVault {
         if let Some(s) = inst.get::<StorageKey, Address>(&StorageKey::Settlement) {
             let ut: Address = inst.get(&StorageKey::UsdcToken).unwrap();
             Self::transfer_funds(&env, &ut, &s, total);
-        } else if inst.get::<StorageKey, Address>(&StorageKey::RevenuePool).is_some() {
+        } else if inst
+            .get::<StorageKey, Address>(&StorageKey::RevenuePool)
+            .is_some()
+        {
             Self::transfer_to_revenue_pool(env.clone(), total);
         }
         meta.balance