Skip to content

Add contract-level duplicate payment detection and rejection #431

Description

@Kingsman-99

Description

Identical payments (same payer, same amount, same ledger) can be submitted twice due to network retries, resulting in double-charging. This issue adds a payment fingerprint registry that detects and rejects duplicate submissions within a configurable ledger window.

Technical Context

Compute a payment fingerprint hash = sha256(invoice_id || payer || amount || ledger_sequence) using env.crypto().sha256() in lib.rs. Store fingerprint_key(hash) -> bool with a TTL of DUPLICATE_WINDOW_LEDGERS. Before processing pay_invoice, check for an existing fingerprint entry; if present, panic with DuplicatePayment. After processing, store the fingerprint.

Acceptance Criteria

  • Payment fingerprint is computed from invoice_id, payer, amount, and current ledger sequence
  • Duplicate submission within DUPLICATE_WINDOW_LEDGERS panics with DuplicatePayment
  • Fingerprint storage uses Soroban temporary storage with correct TTL so old entries expire automatically
  • Different amounts from the same payer in the same ledger are NOT considered duplicates
  • DUPLICATE_WINDOW_LEDGERS is admin-configurable; default 5 ledgers
  • Tests: identical call twice fails, same payer different amount passes, after window expiry same call succeeds
  • All CI checks (cargo test, cargo clippy, cargo fmt) pass and the branch has no merge conflicts

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Labels

Stellar WaveIssues in the Stellar wave programcomplexity: highComplex feature requiring deep knowledge - 200 ptsfeatureNew contract feature or operation

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions