set_pool_wasm_hash does not validate the hash is valid WASM

[ritaifeoluwa]

Description

The Factory contract's set_pool_wasm_hash function does not validate that the new hash is a valid WASM module. It accepts any 32-byte hash.

Current behavior

pub fn set_pool_wasm_hash(env: Env, new_hash: BytesN<32>) -> Result<(), FactoryError> {
    // No validation on new_hash
}

Expected behavior

Consider:

• Uploading and validating the WASM before setting the hash
• Or documenting that callers must verify the hash separately
• Or storing the WASM bytes alongside the hash for verification

Why this matters

Setting an invalid hash would cause all future pool deployments to fail.

Labels

security, factory, hard

[Calebstack]

@Calebstack has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hello maintainer, i’ve got this covered! Ready to drop a high-impact, clean PR that gets this merged seamlessly

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Calebstack to this issue.

[adetomiwa21]

@adetomiwa21 has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

hello maintainer, please assign me

ℹ️ Repo Maintainers: To accept this application, review their application or assign @adetomiwa21 to this issue.

[drips-wave]

Congratulations, @adetomiwa21! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on August 31, 2026.

🧑‍💻 @adetomiwa21: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊

[grantfox-oss]

🎉 This issue has been marked as completed on GrantFox as part of the Third Campaign campaign!

@adetomiwa21's PR #212 was approved and merged by @ritaifeoluwa.

🏆 @adetomiwa21: You earned 35 FoxPoints for this contribution! Your current tier: Explorer (414 total points). Track your full progress on GrantFox.

👏 Great work, @adetomiwa21! Keep contributing to SmartDropLabs.

[drips-wave]

This issue has been completed by @adetomiwa21 as part of the Stellar Wave Program's 8th Wave 🥳

😎 @adetomiwa21: You earned 200 Points for completing this issue! After the current Wave ends, you'll be eligible for a percentage of the Wave's reward pool based on the percentage of total points you've earned. Learn more here. You can also Leave a review to share your experience working on this issue.

🧑‍💻 Repo maintainers: How'd the contributor do? Leave a review to share your experience working with them.