fix(wallet,profile,contracts): resolve issues #329, #343, #345, and #346

[GF-Hunter]

Description

This pull request resolves four assigned issues across frontend and smart contracts:

1. Issue [frontend] - WithdrawModal does not display the user current balance requiring them to navigate away to check it #329: [frontend] - WithdrawModal does not display the user current balance requiring them to navigate away to check it

   • Added formatted available balance display (Available: ₦10,000.00) inside WithdrawModal.
   • Added a "Max" button that fills the amount input with the user's full available balance.
   • Added unit test in frontend/app/wallet/withdraw.test.tsx verifying available balance rendering and Max button input population.

2. Issue [frontend] - Profile page account deletion does not require confirmation phrase risking accidental deletion #343: [frontend] - Profile page account deletion does not require confirmation phrase risking accidental deletion

   • Added Danger Zone section to the profile page with "Delete account" flow.
   • Implemented accessible confirmation modal requiring the user to type "DELETE MY ACCOUNT" (case-insensitive).
   • Enforced a 5-second countdown timer before the confirm button becomes clickable.
   • Added Playwright e2e test in frontend/e2e/profile-delete.spec.ts asserting that the confirm button remains disabled until both the exact confirmation phrase is entered and the 5s timer expires.

3. Issue [contract] - Marketplace create_listing does not support updating listing price or expiry after creation #345: [contract] - Marketplace create_listing does not support updating listing price or expiry after creation

   • Implemented update_listing(env, seller, listing_id, new_price, new_expires_at) on MarketplaceContract.
   • Enforced seller authorization (seller.require_auth()) and checked listing.seller == seller.
   • Restricted updates strictly to listings in Active status.
   • Emitted updated event (topics: ["updated"], data: (listing_id, seller, new_price, new_expires_at)).
   • Added comprehensive tests covering authorized updates, unauthorized attempts, and invalid status transitions.

4. Issue [contract] - Neither contract has an emergency withdrawal function for trapped funds in event of a critical bug #346: [contract] - Neither contract has an emergency withdrawal function for trapped funds in event of a critical bug

   • Added emergency_withdraw(env, token, recipient, amount) to both Escrow and Marketplace contracts.
   • Restricted access strictly to admin (admin.require_auth()) and required contract to be in Paused state.
   • Enforced a mandatory 72-hour timelock (EMERGENCY_TIMELOCK_SECS = 259_200) between pause and emergency_withdraw to mitigate admin rug-pull risks.
   • Emitted high-severity emergency_withdrawal event.
   • Added unit tests covering successful withdrawal after timelock, failure prior to timelock expiry, and failure when unpaused.
   • Documented the emergency withdrawal threat vector, mitigations, and security model in contracts/THREAT_MODEL.md.

Related Issues

• Closes [frontend] - WithdrawModal does not display the user current balance requiring them to navigate away to check it #329
• Closes [frontend] - Profile page account deletion does not require confirmation phrase risking accidental deletion #343
• Closes [contract] - Marketplace create_listing does not support updating listing price or expiry after creation #345
• Closes [contract] - Neither contract has an emergency withdrawal function for trapped funds in event of a critical bug #346

[drips-wave]

@GF-Hunter Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits