-
Notifications
You must be signed in to change notification settings - Fork 132
scholarship_treasury: submit_proposal hardcodes exactly 3 milestones #564
Copy link
Copy link
Open
Description
Bug
submit_proposal validates that both milestone_titles and milestone_dates have exactly 3 entries, but the Proposal struct stores them as Vec<String> with no inherent length limit, and no other contract logic enforces 3 milestones anywhere else.
File: contracts/scholarship_treasury/src/lib.rs
if amount <= 0 || milestone_titles.len() != 3 || milestone_dates.len() != 3 {
panic_with_error!(&env, Error::InvalidAmount); // ← wrong error too
}Issues:
- The magic number
3is undocumented and not configurable. - The error used (
InvalidAmount) is misleading — this is a validation failure on milestone count, not on amount. - Milestone count should be a configurable parameter (e.g., stored at init time) rather than a compile-time constant.
Fix
- Add a
milestone_countconfig stored at initialize time (defaulting to 3 for backwards compatibility). - Add an
InvalidMilestoneCounterror variant. - Validate
milestone_titles.len() == configured_milestone_count.
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
No labels