scholarship_treasury: execute_proposal does not check quorum — can disburse on low participation

[Anuoluwapo25]

Bug

execute_proposal checks total_votes >= quorum_threshold against the raw vote count returned by get_quorum, but get_quorum returns whatever value was stored at initialization (or 0 by default). If quorum_threshold is 0 (the default), the quorum gate is trivially satisfied even with zero votes, so a proposal with 0 yes_votes and 0 no_votes can be executed and funds disbursed.

File: contracts/scholarship_treasury/src/lib.rs ~line 412

let passed = total_votes >= quorum_threshold   // 0 >= 0 → true when both are 0
    && total_votes > 0                          // this guard saves it, but only by accident
    && ...

The total_votes > 0 guard currently papers over the bug, but it is not documented as intentional and could be removed in a future refactor.

Fix

Require quorum_threshold > 0 at initialize time and in set_quorum, and document that quorum_threshold is a hard minimum number of votes (not basis-points). Alternatively, enforce quorum as a fraction of TOTAL_GOV_KEY (which is already tracked) to be resistant to low-turnout attacks.