create_vesting bypasses pause state check in learn-token

[DeFiVC]

What

create_vesting (learn-token lib.rs:1479) does not call Self::require_not_paused(&env). The admin can create new vesting schedules while the contract is emergency-paused.

Compare with claim_vested (lib.rs:1523) which correctly checks pause.

// create_vesting -- no pause check:
pub fn create_vesting(...) {
    let admin = storage::get_admin(&env);
    admin.require_auth();  // line 1487 -- no require_not_paused
    ...
}

// claim_vested -- checks pause:
pub fn claim_vested(...) {
    Self::require_not_paused(&env);  // line 1523
    ...
}

Why

During an emergency pause, an admin could create vesting schedules that lock tokens, potentially as part of an attack or to prepare actions for when the contract is unpaused. The pause should freeze all state-changing operations.

Scope

Add Self::require_not_paused(&env); at line 1486, before admin.require_auth().

Acceptance Criteria

• create_vesting panics when the contract is paused
• Test verifies vesting creation is blocked during pause

Technical Context

• contracts/learn-token/src/lib.rs:1479-1514 -- create_vesting (missing pause check)
• contracts/learn-token/src/lib.rs:1522-1598 -- claim_vested (checks pause)

[Fatsaf]

@Fatsaf has applied to work on this issue as part of the Stellar Wave Program's 9th wave.

I’d like to work on this issue. I’m ready to start immediately and will aim to deliver a clean fix quickly.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Fatsaf to this issue.

[MorsH14]

@MorsH14 has applied to work on this issue as part of the Stellar Wave Program's 9th wave.

I'll love to work on this issue asap

ℹ️ Repo Maintainers: To accept this application, review their application or assign @MorsH14 to this issue.

[dvreolv-ux]

@dvreolv-ux has applied to work on this issue as part of the Stellar Wave Program's 9th wave.

I’m interested in taking this up and would appreciate the assignment.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @dvreolv-ux to this issue.

[optimism932-dotcom]

@optimism932-dotcom has applied to work on this issue as part of the Stellar Wave Program's 9th wave.

Kindly assign this task to me.
I can fix it

ℹ️ Repo Maintainers: To accept this application, review their application or assign @optimism932-dotcom to this issue.

[Elias02-code]

@Elias02-code has applied to work on this issue as part of the Stellar Wave Program's 9th wave.

I'd love to take on this issue to ensure contract operations are properly frozen during an emergency pause. I will add Self::require_not_paused(&env) to create_vesting in contracts/learn-token/src/lib.rs and write a test to verify that vesting creation panics when paused.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Elias02-code to this issue.

[339mon]

@339mon has applied to work on this issue as part of the Stellar Wave Program's 9th wave.

Hi, kindly assign, i would love to fix

ℹ️ Repo Maintainers: To accept this application, review their application or assign @339mon to this issue.

[brite-side0]

@brite-side0 has applied to work on this issue as part of the Stellar Wave Program's 9th wave.

hello dear maintainer i would love to work along side you on this task sir so as to bring it up to the level of production.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @brite-side0 to this issue.

[Akintobidavid]

@Akintobidavid has applied to work on this issue as part of the Stellar Wave Program's 9th wave.

I've reviewed this issue, and it's a real gap in pause enforcement. I'll add Self::require_not_paused(&env); at line 1486 in create_vesting (before admin.require_auth()), matching claim_vested's pattern, with a test confirming vesting creation is blocked while paused.

Please assign this issue to me, you won't be disappointed, thank you.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Akintobidavid to this issue.

[Peaostrel]

@Peaostrel has applied to work on this issue as part of the Stellar Wave Program's 9th wave.

i can handle this quickly

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Peaostrel to this issue.

[dammy-lab]

@dammy-lab has applied to work on this issue as part of the Stellar Wave Program's 9th wave.

I would love to work on this issue because, the problem is clearly isolated in create_vesting, where the function allows an administrator to modify contract state without first checking whether the contract is paused. I would also run the relevant formatting, linting, and test suites to make sure the change does not introduce regressions and remains consistent with the existing claim_vested pause-check pattern.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @dammy-lab to this issue.

[Husinat]

@Husinat has applied to work on this issue as part of the Stellar Wave Program's 9th wave.

Hello! I understand and can fix this issue up please assign to me🙏

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Husinat to this issue.