Skip to content

Fix SDK fundInvoice missing require_oracle_verification parameter #594

Description

@Levi-Ojukwu

Description:

The SDK's fundInvoice method constructs a contract call with only 3 arguments (funder, invoice_id, fund_amount), but the contract's fund_invoice function accepts 4 user arguments including require_oracle_verification: bool. This causes either:

  1. Transaction failure due to argument count mismatch on every LP funding attempt through the SDK, or
  2. Silent oracle verification bypass if Soroban deserializes the missing bool as false, allowing unverified/risky payers to be funded — defeating a critical security control.

The contract signature is:

pub fn fund_invoice(env: Env, funder: Address, invoice_id: u64, fund_amount: i128, require_oracle_verification: bool) -> Result<(), ContractError>

The SDK call at sdk/src/methods/fundInvoice.ts:309-313 omits the fourth argument entirely.

Why it matters: This is a ship-blocker — no LP can fund invoices through the SDK without this fix. If Soroban defaults the missing bool to false, payer verification is completely bypassed, creating a systemic credit risk.

Acceptance Criteria:

  • Add require_oracle_verification parameter to fundInvoice SDK method signature
  • Pass the parameter in the contract call via nativeToScVal
  • Update all callers and tests to provide the parameter
  • Add test verifying oracle verification is enforced when parameter is true
  • Add test verifying parameter is correctly forwarded to contract

Relevant Files: sdk/src/methods/fundInvoice.ts:308-314, contracts/invoice_liquidity/src/lib.rs:1050-1056


Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions