[hpmaxi]

Summary

Closes #332

After setup, a compliance or verifier swap on the share token waited for the timelock, but nothing checked the new contract. A compliance contract that did not list the token stopped every mint, transfer and burn. A verifier that did not answer made every holder look delisted.

The token now checks the new contract when the swap is proposed and again when it applies, as the vault does for a new oracle feed.

Changes

• A compliance swap needs a contract that names the token's vault, has its setup closed and lists the token (ComplianceNotBound, 7017).
• A verifier swap needs a verifier that accepts the vault's address (VerifierRefusesVault, 7018).
• A missing or failing contract counts as a refusal.
• The test that pinned an unbound swap landing now expects the refusal.

Deviations

• Timelock tests that used a swap to a random address as filler now use a role grant.
• The vault's silent-verifier test now sets the verifier in storage, since a swap refuses it.
• The network guard that checks the compliance account cannot propose a token change named the compliance contract as the new verifier. That contract now fails the check in simulation, before the signature, so the guard proposes the deployed verifier instead.

Acceptance criteria

• A compliance swap is refused unless the new contract names this token's vault, has finished its setup, and has this token bound
• An identity-verifier swap is refused unless the new verifier answers and accepts the vault's address
• Both checks run when the change is proposed and again when it applies, and a contract that does not answer fails them
• Tests cover each refusal and a valid swap, and the docs list the checks

Test plan

Automated tests

1. Run SOROBAN_SDK_BUILD_SYSTEM_SUPPORTS_SPEC_SHAKING_V2=1 cargo test --locked. Expect 728 passed, 0 failed (721 before: 7 new tests, 2 updated).
2. Run cargo clippy --locked --all-targets -- -D warnings. Expect no warnings.
3. Run cargo fmt --all -- --check. Expect no output.
4. Run stellar contract build --package share-token. Expect 56,531 bytes optimized (55,315 before).
5. Build the Wasm as the CI step "Run the Wasm upgrade tests" does, then run SOROBAN_SDK_BUILD_SYSTEM_SUPPORTS_SPEC_SHAKING_V2=1 cargo test --locked -p async-vault -p nav-oracle --features upgrade_wasm with_wasm. Expect 7 passed, including the_token_upgrades_under_live_balances_and_open_requests.
6. On a local network started from the CI image, run in scripts/harness with HARNESS_NETWORK=local: npm run deploy, npm run test:happy-path, npm run test:guards, then build the vault with CARGO_TARGET_DIR=target/short-wind-down stellar contract build --package async-vault --features short_wind_down and run npm run test:wind-down. Expect 24, 50 and 6 passed.

Manual verification

None.

Breaking changes

After setup, a compliance swap to a contract that does not answer VaultBinding is refused, though finish_setup accepts such an external module. The design doc now says so. Generated clients gain two error variants.

Checklist

• Self-reviewed my own diff
• Tests added or updated
• Docs updated (if applicable)
• No unrelated changes bundled in

Screenshots

None.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
strata-vault-kit-app	Ready	Preview	Oct 22, 2026 7:04pm UTC