Issues

• No property-based fuzz tests for task-registry or reward-engine — only eco-token has proptest coverage

  advancedGrantFox OSSMaybe Rewardedreward-enginetask-registrytestingThird Campaign
  ecotask-network/EcoTask-contract#86 · Filter by author cybermax4200 opened on Aug 26, 2026
  3

  

• BurnEvent emits from as unindexed data — on-chain burn history cannot be filtered by address

  bugeco-tokenGrantFox OSSintermediateMaybe RewardedobservabilityThird Campaign
  ecotask-network/EcoTask-contract#85 · Filter by author cybermax4200 opened on Aug 26, 2026
  2

  

• Oracle auth check is O(n) linear scan on every proof submission — degrades with multi-oracle deployments

  advancedbugGrantFox OSSMaybe Rewardedreward-enginestorageThird Campaign
  ecotask-network/EcoTask-contract#75 · Filter by author cybermax4200 opened on Aug 23, 2026
  6

  

• UserVerifications(Address) is an unbounded persistent Vec<u64> — same O(n) storage corruption class as the fixed CreatorTasks bug

  advancedbugGrantFox OSSMaybe Rewardedreward-enginestorageThird Campaign
  ecotask-network/EcoTask-contract#73 · Filter by author cybermax4200 opened on Aug 23, 2026
  5

  

• No event emitted when transfer_admin succeeds in any contract; admin handover is silent on-chain

  bugeco-tokenGrantFox OSSintermediateMaybe Rewardedobservabilityreward-enginetask-registryThird Campaign
  ecotask-network/EcoTask-contract#55 · Filter by author cybermax4200 opened on Aug 17, 2026
  3

  

• set_oracle and add_oracle/remove_oracle are duplicate, conflicting APIs; set_oracle silently drops all existing oracles

  api-designbugGrantFox OSSMaybe Rewardedreward-engineThird Campaign
  ecotask-network/EcoTask-contract#43 · Filter by author cybermax4200 opened on Aug 17, 2026
  5

  

• list_tasks in the registry does a sequential ID scan; deleted/non-existent IDs silently shrink pages without warning

  api-designbugGrantFox OSSintermediateMaybe Rewardedtask-registryThird Campaign
  ecotask-network/EcoTask-contract#40 · Filter by author cybermax4200 opened on Aug 17, 2026
  3

  

• task_type has no maximum length validation; unbounded strings inflate on-chain storage cost per task

  bugcorrectnessGrantFox OSSintermediateMaybe Rewardedtask-registryThird Campaign
  ecotask-network/EcoTask-contract#35 · Filter by author cybermax4200 opened on Aug 17, 2026
  2

  

• reward-engine set_token and set_registry have no validation; swapping to an uninitialised contract address silently breaks the engine

  bugGrantFox OSSMaybe RewardedsecurityThird Campaign
  ecotask-network/EcoTask-contract#32 · Filter by author cybermax4200 opened on Aug 17, 2026
  3