Issues

• platform_stats::health's storage_ok field is a tautology — it can never report false

  bugContractStellar Wave
  dupdab/dupdapp_stellar#1126 · Filter by author martinzhames opened on Sep 22, 2026
  4

  

• platform_stats: active_payments_24h is a fixed ledger-aligned bucket, not a true rolling 24-hour window

  bugContractStellar Wave
  dupdab/dupdapp_stellar#1125 · Filter by author martinzhames opened on Sep 22, 2026
  4

  

• platform_stats: ActiveBucket entries accumulate forever in instance storage, one per 24h period, never pruned

  bugContractStellar Wave
  dupdab/dupdapp_stellar#1124 · Filter by author martinzhames opened on Sep 22, 2026
  4

  

• platform_stats::record_payment accepts caller-supplied amount_usd and settled with no on-chain corroboration

  bugContractStellar Wave
  dupdab/dupdapp_stellar#1123 · Filter by author martinzhames opened on Sep 22, 2026
  4

  

• platform_stats: counters never decrement — total_merchants/total_settled_volume_usd drift from reality over time

  bugContractStellar Wave
  dupdab/dupdapp_stellar#1122 · Filter by author martinzhames opened on Sep 22, 2026
  4

  

• platform_stats: counter overflow protection relies entirely on the workspace's overflow-checks build flag, not explicit checked arithmetic

  bugContractStellar Wave
  dupdab/dupdapp_stellar#1121 · Filter by author martinzhames opened on Sep 22, 2026
  4

  

• payment_request::create_payment has no validation on amount or expiry

  bugContractStellar Wave
  dupdab/dupdapp_stellar#1116 · Filter by author martinzhames opened on Sep 22, 2026
  5

  

• payment_request: no admin/operator concept exists at all — contrast with every other contract in this repo

  adminbugContractStellar Wave
  dupdab/dupdapp_stellar#1115 · Filter by author martinzhames opened on Sep 22, 2026
  4

  

• payment_request: confirm/set_settling/settle/fail/expire have zero access control — any address can drive any payment's state machine

  authbugContractpaymentsStellar Wave
  dupdab/dupdapp_stellar#1114 · Filter by author martinzhames opened on Sep 22, 2026
  4

  

• payment_escrow: the highest-risk functions (upgrade, emergency_drain's XLM path, set_registry(None)) have the thinnest test coverage

  ContractenhancementStellar Wavetest
  dupdab/dupdapp_stellar#1113 · Filter by author martinzhames opened on Sep 22, 2026
  4

  

• payment_escrow: dispute resolution is all-or-nothing on the remainder even after a merchant has already delivered via partial release

  ContractenhancementpaymentsStellar Wave
  dupdab/dupdapp_stellar#1108 · Filter by author martinzhames opened on Sep 22, 2026
  4

  

• payment_escrow::dispute's _reason parameter is misleadingly underscore-prefixed despite being used, and has no validation

  bugContractStellar Wave
  dupdab/dupdapp_stellar#1107 · Filter by author martinzhames opened on Sep 22, 2026
  4

  

• payment_escrow::emergency_drain only covers the USDC token — XLM-denominated escrows are unreachable by the emergency path

  bugContractpaymentsStellar Wave
  dupdab/dupdapp_stellar#1106 · Filter by author martinzhames opened on Sep 22, 2026
  4

  

• payment_escrow::emergency_drain sweeps the ENTIRE contract balance, including active/undisputed escrows, not just stuck funds

  bugContractpaymentsStellar Wave
  dupdab/dupdapp_stellar#1105 · Filter by author martinzhames opened on Sep 22, 2026
  3