Fix outstanding vault issue set

.github/workflows/codeql.yml

@@ -0,0 +1,213 @@
+name: CodeQL Security Scanning
+
+on:
+  pull_request:
+    branches:
+      - main
+      - develop
+  push:
+    branches:
+      - main
+      - develop
+  schedule:
+    - cron: '0 6 * * 1' # Weekly Monday 06:00 UTC
+
+permissions:
+  contents: read
+  security-events: write
+  actions: read
+
+jobs:
+  analyze-rust:
+    name: CodeQL (Rust)
+    runs-on: ubuntu-latest
+    if: >-
+      github.event_name == 'schedule' ||
+      github.event_name == 'push' ||
+      (github.event_name == 'pull_request' &&
+       (github.event.pull_request.base.ref == 'main' || github.event.pull_request.base.ref == 'develop'))
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: ['rust']
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Setup Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt
+
+      - name: Cache Rust dependencies
+        uses: Swatinem/rust-cache@v2
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: ${{ matrix.language }}
+          config: |
+            paths:
+              - contracts/
+            paths-ignore:
+              - contracts/mock-strategy/
+              - contracts/vault/src/test.rs
+              - contracts/vault/src/fuzz_math.rs
+              - contracts/vault/src/*_tests.rs
+            query-filters:
+              - exclude:
+                  id: rust/unsafe-cast
+
+      - name: Build Rust contracts
+        run: |
+          cargo build --release --target wasm32-unknown-unknown -p vault 2>&1 || \
+          cargo build --release -p vault 2>&1 || true
+        working-directory: contracts
+        env:
+          RUSTFLAGS: "-C link-arg=-s"
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: "/language:${{ matrix.language }}"
+          output: rust-results
+
+      - name: Upload Rust security artifacts
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: codeql-rust-results
+          path: rust-results/
+          retention-days: 90
+
+  analyze-typescript:
+    name: CodeQL (TypeScript)
+    runs-on: ubuntu-latest
+    if: >-
+      github.event_name == 'schedule' ||
+      github.event_name == 'push' ||
+      (github.event_name == 'pull_request' &&
+       (github.event.pull_request.base.ref == 'main' || github.event.pull_request.base.ref == 'develop'))
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: ['typescript']
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: npm
+          cache-dependency-path: |
+            backend/package-lock.json
+            frontend/package-lock.json
+            packages/api-schemas/package-lock.json
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: ${{ matrix.language }}
+          config: |
+            paths:
+              - frontend/src/
+              - backend/src/
+              - packages/api-schemas/
+            paths-ignore:
+              - '**/*.test.ts'
+              - '**/*.test.tsx'
+              - '**/*.spec.ts'
+              - '**/*.spec.tsx'
+              - '**/node_modules/'
+
+      - name: Install backend dependencies
+        run: npm ci
+        working-directory: backend
+
+      - name: Install frontend dependencies
+        run: npm ci
+        working-directory: frontend
+
+      - name: Build shared API schemas
+        run: npm ci && npm run build
+        working-directory: packages/api-schemas
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v3
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: "/language:${{ matrix.language }}"
+          output: ts-results
+
+      - name: Upload TypeScript security artifacts
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: codeql-typescript-results
+          path: ts-results/
+          retention-days: 90
+
+  security-review:
+    name: Security Review Summary
+    runs-on: ubuntu-latest
+    needs: [analyze-rust, analyze-typescript]
+    if: always()
+
+    steps:
+      - name: Download all CodeQL artifacts
+        uses: actions/download-artifact@v4
+        with:
+          path: all-results/
+          pattern: codeql-*-results
+          merge-multiple: true
+
+      - name: Generate security review summary
+        run: |
+          echo "## CodeQL Security Scan Results" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "**Scan completed at:** $(date -u '+%Y-%m-%d %H:%M:%S UTC')" >> $GITHUB_STEP_SUMMARY
+          echo "**Triggered by:** ${{ github.event_name }}" >> $GITHUB_STEP_SUMMARY
+          echo "**Branch:** ${{ github.ref_name }}" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "### Rust Contracts" >> $GITHUB_STEP_SUMMARY
+          if [ -d "all-results/rust-results" ]; then
+            echo "Results available in CodeQL security tab." >> $GITHUB_STEP_SUMMARY
+          else
+            echo "No Rust results generated." >> $GITHUB_STEP_SUMMARY
+          fi
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "### TypeScript (Frontend + Backend)" >> $GITHUB_STEP_SUMMARY
+          if [ -d "all-results/ts-results" ]; then
+            echo "Results available in CodeQL security tab." >> $GITHUB_STEP_SUMMARY
+          else
+            echo "No TypeScript results generated." >> $GITHUB_STEP_SUMMARY
+          fi
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "### Next Steps" >> $GITHUB_STEP_SUMMARY
+          echo "1. Review any alerts in the GitHub Security tab" >> $GITHUB_STEP_SUMMARY
+          echo "2. Triage findings by severity (error > warning > note)" >> $GITHUB_STEP_SUMMARY
+          echo "3. Address critical/high findings before merge" >> $GITHUB_STEP_SUMMARY
+
+      - name: Notify Slack on security findings
+        if: failure()
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SECURITY_SLACK_WEBHOOK_URL }}
+        run: |
+          if [ -z "$SLACK_WEBHOOK_URL" ]; then
+            echo "SECURITY_SLACK_WEBHOOK_URL secret not set; skipping notification."
+            exit 0
+          fi
+          text="🔍 CodeQL scan completed on *${GITHUB_REPOSITORY}* (${GITHUB_REF_NAME}). Review security findings in the GitHub Security tab."
+          payload=$(jq -n --arg text "$text" '{text: $text}')
+          curl --fail --silent --show-error -X POST \
+            -H "Content-Type: application/json" \
+            --data "$payload" \
+            "$SLACK_WEBHOOK_URL"

Cargo.toml

@@ -4,6 +4,7 @@ members = [
     "contracts/vault",
     "contracts/mock-strategy",
     "contracts/share-price-math",
+    "contracts/bridge-compat",
 ]
 
 [workspace.dependencies]

contracts/bridge-compat/Cargo.toml

@@ -0,0 +1,24 @@
+[package]
+name = "bridge-compat"
+version = "0.1.0"
+edition = "2021"
+
+[lib]
+crate-type = ["cdylib"]
+
+[dependencies]
+soroban-sdk = { workspace = true }
+
+[dev-dependencies]
+soroban-sdk = { workspace = true, features = ["testutils"] }
+
+[profile.release]
+opt-level = "z"
+overflow-checks = true
+debug = 0
+strip = "symbols"
+debug-assertions = false
+panic = "abort"
+codegen-units = 1
+lto = true
+incremental = false