Skip to content

SECURITY.md audit scope line counts are significantly understated #487

Closed
#658
Closed
SECURITY.md audit scope line counts are significantly understated#487
#658
Assignees
Joeloo1
Labels
Stellar WaveIssues in the Stellar wave programdocumentationImprovements or additions to documentationlowCosmetic, minor improvement, code quality, documentation

Description

@DeFiVC
DeFiVC
opened on Sep 30, 2026

What

SECURITY.md lines 181-187 list the audit scope with line counts that are roughly half the actual values:

Contract Listed Actual (lib.rs alone)
learn-token ~1400 2700+
credential-nft ~750 1500+
progress-tracker ~1500 2800+
Total ~3710 6500+

Why

Security auditors and contributors rely on these numbers to estimate review effort. Understating the code size by nearly 2x could lead to insufficient review coverage.

Scope

Update the line counts in SECURITY.md to reflect the current codebase. Include all source files (lib.rs, storage.rs, events.rs, types.rs, metadata.rs, etc.) not just the main lib.rs.

Acceptance Criteria

  • Line counts are accurate (within 10% of actual)
  • All source files in each contract are counted

Technical Context

  • SECURITY.md:181-187 -- audit scope section

Activity

  1. DeFiVC
    added
    documentationImprovements or additions to documentation
    Stellar WaveIssues in the Stellar wave program
    lowCosmetic, minor improvement, code quality, documentation
    on Sep 30, 2026

  2. Johnsource-hub commented on Sep 30, 2026

    @Johnsource-hub
    Johnsource-hub
    on Sep 30, 2026 – with Drips Wave

    @Johnsource-hub has applied to work on this issue as part of the Stellar Wave Program's 9th wave.

    Hi! I’d like to work on this issue if it’s still available.
    I have experience building web applicationsand I’m comfortable working with Git and collaborative development workflows. I’m confident I can implement a clean, maintainable solution while following the project’s contribution guidelines.

    ℹ️ Repo Maintainers: To accept this application, review their application or assign @Johnsource-hub to this issue.

  3. Maxl500 commented on Sep 30, 2026

    @Maxl500
    Maxl500
    on Sep 30, 2026 – with Drips Wave

    @Maxl500 has applied to work on this issue as part of the Stellar Wave Program's 9th wave.

    Hello, I’ve reviewed the task and the requirements are clear. I’m ready to work on it

    ℹ️ Repo Maintainers: To accept this application, review their application or assign @Maxl500 to this issue.

  4. Hibhee01 commented on Sep 30, 2026

    @Hibhee01
    Hibhee01
    on Sep 30, 2026 – with Drips Wave

    @Hibhee01 has applied to work on this issue as part of the Stellar Wave Program's 9th wave.

    Hello Maintainer, I reviewed the issue carefully and the requirements are clear to me. I’m ready to take ownership of the task and work toward a clean implementation that satisfies the acceptance criteria.

    ℹ️ Repo Maintainers: To accept this application, review their application or assign @Hibhee01 to this issue.

  5. dhikbass commented on Sep 30, 2026

    @dhikbass
    dhikbass
    on Sep 30, 2026 – with Drips Wave

    @dhikbass has applied to work on this issue as part of the Stellar Wave Program's 9th wave.

    Hi, I analyzed the requirements and pinpointed the code changes needed. I can implement the fix carefully and verify the expected results.

    ℹ️ Repo Maintainers: To accept this application, review their application or assign @dhikbass to this issue.

  6. Oprimecloud commented on Sep 30, 2026

    @Oprimecloud
    Oprimecloud
    on Sep 30, 2026 – with Drips Wave

    @Oprimecloud has applied to work on this issue as part of the Stellar Wave Program's 9th wave.

    Hi team, I'd love to take this on. If you could assign this issue to me, I'll dig into the repo and get a fix up for review shortly. Thanks!

    ℹ️ Repo Maintainers: To accept this application, review their application or assign @Oprimecloud to this issue.

  7. solaawojobi00-bit commented on Sep 30, 2026

    @solaawojobi00-bit
    solaawojobi00-bit
    on Sep 30, 2026 – with Drips Wave

    @solaawojobi00-bit has applied to work on this issue as part of the Stellar Wave Program's 9th wave.

    Kindly assign to me. I can solve it in 1 hour. Don't worry about time.

    ℹ️ Repo Maintainers: To accept this application, review their application or assign @solaawojobi00-bit to this issue.

  8. umarhussainiagaie-bot commented on Sep 30, 2026

    @umarhussainiagaie-bot
    umarhussainiagaie-bot
    on Sep 30, 2026 – with Drips Wave

    @umarhussainiagaie-bot has applied to work on this issue as part of the Stellar Wave Program's 9th wave.

    Assign this issue for me, I can handle this issue

    ℹ️ Repo Maintainers: To accept this application, review their application or assign @umarhussainiagaie-bot to this issue.

  9. drmfsltdoh commented on Sep 30, 2026

    @drmfsltdoh
    drmfsltdoh
    on Sep 30, 2026 – with Drips Wave

    @drmfsltdoh has applied to work on this issue as part of the Stellar Wave Program's 9th wave.

    I would like to work on correcting the http://SECURITY.md audit scope line counts — experienced in auditing documentation accuracy, repository analysis, and maintaining security docs to reflect actual codebase metrics.

    ℹ️ Repo Maintainers: To accept this application, review their application or assign @drmfsltdoh to this issue.

  10. shobhamerabacha-star commented on Oct 7, 2026

    @shobhamerabacha-star
    shobhamerabacha-star
    on Oct 7, 2026

    Greetings,

    I would like to work on this issue.

    Solution overview:

    1. Audit storage layout and state invariants ensuring strict auth guards.
    2. Implement deterministic state transitions with safe checked arithmetic.
    3. Add hermetic unit and regression tests covering authorized, unauthorized, and boundary edge cases.
    4. Profile instruction and CPU/gas limits under Soroban host environment.

    Ready to implement immediately upon assignment. Please feel free to assign!

  11. DeFiVC
    removed
    Stellar WaveIssues in the Stellar wave program
    on Oct 19, 2026
  12. drips-wave
    added
    Stellar WaveIssues in the Stellar wave program
    on Oct 19, 2026

  13. Gabriel-123-diamond commented on Oct 19, 2026

    @Gabriel-123-diamond
    Gabriel-123-diamond
    on Oct 19, 2026 – with Drips Wave

    @Gabriel-123-diamond has applied to work on this issue as part of the Stellar Wave Program's 10th wave.

    I would like to correct the audit-scope inventory. I will enumerate every source file under each listed contract, including storage, events, types, metadata, and other modules, and recalculate per-contract and aggregate line counts from the current checkout. I will document a consistent counting method and the revision used so auditors can reproduce the totals, distinguish production and test code where applicable, and update only the relevant SECURITY.md scope section. I will verify that all source files are represented and the totals meet the stated accuracy requirement.

    ℹ️ Repo Maintainers: To accept this application, review their application or assign @Gabriel-123-diamond to this issue.

  14. Joeloo1 commented on Oct 19, 2026

    @Joeloo1
    Joeloo1
    on Oct 19, 2026 – with Drips Wave
    Contributor

    @Joeloo1 has applied to work on this issue as part of the Stellar Wave Program's 10th wave.

    I’d like to work on this issue. Please assign it to me. Thanks!

    ℹ️ Repo Maintainers: To accept this application, review their application or assign @Joeloo1 to this issue.

  15. DeFiVC
    assigned
    Joeloo1
    on Oct 19, 2026

  16. drips-wave commented on Oct 19, 2026

    @drips-wave
    drips-waveBot
    on Oct 19, 2026 – with Drips Wave

    Congratulations, @Joeloo1! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on October 22, 2026.

    🧑‍💻 @Joeloo1: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

    Warning

    When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

    🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

    🌊 Happy Wave 🌊

  17. DeFiVC
    added a commit that references this issue on Oct 19, 2026

    fix: audit scope counts, redeploy guide, and pause guards (#487, #488, …

    d4c795c
  18. DeFiVC
    closed this as completedin #658on Oct 19, 2026

  19. grantfox-oss commented on Oct 19, 2026

    @grantfox-oss
    grantfox-ossBot
    on Oct 19, 2026 – with GrantFox OSS

    🎉 This issue has been marked as completed on GrantFox!

    @Joeloo1's PR #658 was approved and merged by @DeFiVC.

    🏆 @Joeloo1: You earned 40 FoxPoints for this contribution! Your current tier: Builder (1,988 total points). Track your full progress on GrantFox.

    👏 Great work, @Joeloo1! Keep contributing to ChainLearnOfficial.

  20. drips-wave commented on Oct 19, 2026

    @drips-wave
    drips-waveBot
    on Oct 19, 2026 – with Drips Wave

    This issue has been completed by @Joeloo1 as part of the Stellar Wave Program's 10th Wave 🥳

    😎 @Joeloo1: You earned 200 Points for completing this issue! Once the Wave's rewards are finalized, you'll be eligible for a percentage of the Wave's reward pool based on the percentage of total points you've earned. Learn more here. You can also Leave a review to share your experience working on this issue.

    🧑‍💻 Repo maintainers: How'd the contributor do? Leave a review to share your experience working with them.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

Stellar WaveIssues in the Stellar wave programdocumentationImprovements or additions to documentationlowCosmetic, minor improvement, code quality, documentation

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions