-
Notifications
You must be signed in to change notification settings - Fork 14
All issues
Issue creation is restricted in this repository
Issues
is:issue state:open
is:issue state:open
Search results
stellar_send, fee_collector, and token_bridge all have a front-runnable initialize() — anyone can seize admin before the legitimate deployer's own init call lands
bugSomething isn't workingSomething isn't workingcontractsSmart contract logicSmart contract logicGrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardIssue may be eligible for a GrantFox rewardOfficial Campaign | FWC26Campaign: Official Campaign | FWC26Campaign: Official Campaign | FWC26securitySecurity concernSecurity concernThird CampaignCampaign: Third CampaignCampaign: Third Campaignvery hardVery difficult / senior-level bounty issueVery difficult / senior-level bounty issueStatus: Open.#58 In StellarSend/contracts;token_bridge: per-holder WBAL entries never TTL-extended — a dormant wrapped-token balance risks archival and traps on read
bugSomething isn't workingSomething isn't workingcontractsSmart contract logicSmart contract logicGrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardIssue may be eligible for a GrantFox rewardOfficial Campaign | FWC26Campaign: Official Campaign | FWC26Campaign: Official Campaign | FWC26Third CampaignCampaign: Third CampaignCampaign: Third Campaignvery hardVery difficult / senior-level bounty issueVery difficult / senior-level bounty issueStatus: Open.#55 In StellarSend/contracts;PaymentRecord's sequence counter is global, not per-sender, making the (from, seq) storage key non-contiguous despite its shape implying otherwise
bugSomething isn't workingSomething isn't workingcontractsSmart contract logicSmart contract logicdocumentationImprovements or additions to documentationImprovements or additions to documentationGrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardIssue may be eligible for a GrantFox rewardOfficial Campaign | FWC26Campaign: Official Campaign | FWC26Campaign: Official Campaign | FWC26Third CampaignCampaign: Third CampaignCampaign: Third Campaignvery hardVery difficult / senior-level bounty issueVery difficult / senior-level bounty issueStatus: Open.#52 In StellarSend/contracts;No test across any of the four contracts simulates Soroban persistent-storage TTL expiry
contractsSmart contract logicSmart contract logicGrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardIssue may be eligible for a GrantFox rewardOfficial Campaign | FWC26Campaign: Official Campaign | FWC26Campaign: Official Campaign | FWC26testingTest coverage relatedTest coverage relatedThird CampaignCampaign: Third CampaignCampaign: Third Campaignvery hardVery difficult / senior-level bounty issueVery difficult / senior-level bounty issueStatus: Open.#51 In StellarSend/contracts;send_payment and create_payment_request accept unbounded memo strings despite a doc comment recommending a 28-byte maximum
bugSomething isn't workingSomething isn't workingcontractsSmart contract logicSmart contract logicGrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardIssue may be eligible for a GrantFox rewardOfficial Campaign | FWC26Campaign: Official Campaign | FWC26Campaign: Official Campaign | FWC26Third CampaignCampaign: Third CampaignCampaign: Third Campaignvery hardVery difficult / senior-level bounty issueVery difficult / senior-level bounty issueStatus: Open.#49 In StellarSend/contracts;stellar_send has no way to enumerate a payer's active subscriptions — no on-chain way to audit outstanding pull-authorized recurring charges
contractsSmart contract logicSmart contract logicenhancementNew feature or requestNew feature or requestGrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardIssue may be eligible for a GrantFox rewardOfficial Campaign | FWC26Campaign: Official Campaign | FWC26Campaign: Official Campaign | FWC26Third CampaignCampaign: Third CampaignCampaign: Third Campaignvery hardVery difficult / senior-level bounty issueVery difficult / senior-level bounty issueStatus: Open.#48 In StellarSend/contracts;StellarSendError::InvalidFeeCollector is dead code — initialize() never validates the fee_collector address
bugSomething isn't workingSomething isn't workingcontractsSmart contract logicSmart contract logicGrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardIssue may be eligible for a GrantFox rewardOfficial Campaign | FWC26Campaign: Official Campaign | FWC26Campaign: Official Campaign | FWC26Third CampaignCampaign: Third CampaignCampaign: Third Campaignvery hardVery difficult / senior-level bounty issueVery difficult / senior-level bounty issueStatus: Open.#47 In StellarSend/contracts;execute_subscription reads fee_bps fresh from global config every execution — admin fee changes retroactively alter live subscriptions without payer re-consent
bugSomething isn't workingSomething isn't workingcontractsSmart contract logicSmart contract logicGrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardIssue may be eligible for a GrantFox rewardOfficial Campaign | FWC26Campaign: Official Campaign | FWC26Campaign: Official Campaign | FWC26securitySecurity concernSecurity concernThird CampaignCampaign: Third CampaignCampaign: Third Campaignvery hardVery difficult / senior-level bounty issueVery difficult / senior-level bounty issueStatus: Open.#46 In StellarSend/contracts;stellar_send: persistent Subscription records are never TTL-extended, risking archival for exactly the long-interval payments the feature exists to serve
bugSomething isn't workingSomething isn't workingcontractsSmart contract logicSmart contract logicGrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardIssue may be eligible for a GrantFox rewardOfficial Campaign | FWC26Campaign: Official Campaign | FWC26Campaign: Official Campaign | FWC26Third CampaignCampaign: Third CampaignCampaign: Third Campaignvery hardVery difficult / senior-level bounty issueVery difficult / senior-level bounty issueStatus: Open.#43 In StellarSend/contracts;fee_collector::collect_fee's obvious access-control fix would break its real caller — no allowlist primitive exists anywhere
contractsSmart contract logicSmart contract logicGrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardIssue may be eligible for a GrantFox rewardOfficial Campaign | FWC26Campaign: Official Campaign | FWC26Campaign: Official Campaign | FWC26securitySecurity concernSecurity concernspikeOpen-ended research/design investigation, not a fixed-scope fixOpen-ended research/design investigation, not a fixed-scope fixThird CampaignCampaign: Third CampaignCampaign: Third Campaignvery hardVery difficult / senior-level bounty issueVery difficult / senior-level bounty issueStatus: Open.#42 In StellarSend/contracts;fee_collector::collect_fee has no reconciliation between claimed amounts and actual balance, and no invariant-check function exists
contractsSmart contract logicSmart contract logicenhancementNew feature or requestNew feature or requestGrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardIssue may be eligible for a GrantFox rewardOfficial Campaign | FWC26Campaign: Official Campaign | FWC26Campaign: Official Campaign | FWC26Third CampaignCampaign: Third CampaignCampaign: Third Campaignvery hardVery difficult / senior-level bounty issueVery difficult / senior-level bounty issueStatus: Open.#41 In StellarSend/contracts;fee_collector has no way to rotate or recover the admin address — a lost key permanently locks withdraw and set_treasury
bugSomething isn't workingSomething isn't workingcontractsSmart contract logicSmart contract logicGrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardIssue may be eligible for a GrantFox rewardOfficial Campaign | FWC26Campaign: Official Campaign | FWC26Campaign: Official Campaign | FWC26securitySecurity concernSecurity concernThird CampaignCampaign: Third CampaignCampaign: Third Campaignvery hardVery difficult / senior-level bounty issueVery difficult / senior-level bounty issueStatus: Open.#40 In StellarSend/contracts;