batch_claim_reward bypasses pause check while claim_reward checks it

[DeFiVC]

What

batch_claim_reward (learn-token lib.rs:717) does not call Self::require_not_paused(&env), while the single claim_reward (lib.rs:634) does. This means batch reward claims can mint tokens even when the contract is emergency-paused.

// claim_reward checks pause:
pub fn claim_reward(...) {
    Self::require_not_paused(&env);  // line 634
    ...
}

// batch_claim_reward does NOT:
pub fn batch_claim_reward(...) {
    learner.require_auth();  // line 723 -- no pause check
    ...
}

Why

batch_claim_reward mints tokens just like claim_reward. If the contract is paused to stop token minting (e.g., due to a discovered exploit), batch_claim_reward remains functional and can still mint tokens.

Scope

Add Self::require_not_paused(&env); at line 723, before learner.require_auth().

Acceptance Criteria

• batch_claim_reward panics when the contract is paused
• Test verifies batch claims are blocked during pause

Technical Context

• contracts/learn-token/src/lib.rs:634 -- claim_reward (checks pause)
• contracts/learn-token/src/lib.rs:717-780 -- batch_claim_reward (missing pause check)

[MorsH14]

@MorsH14 has applied to work on this issue as part of the Stellar Wave Program's 9th wave.

I'll love to work on this issue asap

ℹ️ Repo Maintainers: To accept this application, review their application or assign @MorsH14 to this issue.

[dvreolv-ux]

@dvreolv-ux has applied to work on this issue as part of the Stellar Wave Program's 9th wave.

I’m interested in taking this up and would appreciate the assignment.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @dvreolv-ux to this issue.

[demola13777]

@demola13777 has applied to work on this issue as part of the Stellar Wave Program's 9th wave.

Hi maintainer, I can resolve this issue very quickly. Pls assign it to me, thanks

ℹ️ Repo Maintainers: To accept this application, review their application or assign @demola13777 to this issue.

[Tinu-ola]

@Tinu-ola has applied to work on this issue as part of the Stellar Wave Program's 9th wave.

Hi. Kindly assign me to this issue.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Tinu-ola to this issue.

[339mon]

@339mon has applied to work on this issue as part of the Stellar Wave Program's 9th wave.

Hi, kindly assign, i would love to fix

ℹ️ Repo Maintainers: To accept this application, review their application or assign @339mon to this issue.

[Sophie2704]

@Sophie2704 has applied to work on this issue as part of the Stellar Wave Program's 9th wave.

Hello Maintainer I'd like to help in fixing this issue please kindly assign it to me

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Sophie2704 to this issue.

[Husinat]

@Husinat has applied to work on this issue as part of the Stellar Wave Program's 9th wave.

Hello! I understand and can quickly fix this issue up please assign to me🙏

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Husinat to this issue.

[Demilade10]

@Demilade10 has applied to work on this issue as part of the Stellar Wave Program's 9th wave.

Hi I can fix this

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Demilade10 to this issue.

[lmduy2612]

I have submitted a pull request fixing this issue in #516. batch_claim_reward now calls Self::require_not_paused(&env) before learner auth, with unit tests passing green.

[Ranjeet2063]

Hi maintainers,

I reviewed this issue and would like to contribute the fix.

Technical outline:

1. Audit storage layout and state invariants ensuring strict auth guards.
2. Implement deterministic state transitions with safe checked arithmetic.
3. Add hermetic unit and regression tests covering authorized, unauthorized, and boundary edge cases.
4. Profile instruction and CPU/gas limits under Soroban host environment.

Please assign this to me if the plan looks good. Thanks!