Repository navigation
payment-router: guard against double-release and reentrancy #58
Description
Problem
Once value movement lands, the classic failure is a state transition that is
checked but not committed before an external call — allowing a second release
against the same escrow.
What to do
- Apply checks-effects-interactions: validate, write the state transition,
then call the token contract. Never the other way round. - Make
releaseandrefundidempotent — a second call on a settled escrow
returnsAlreadySettled, not another transfer. - Add invariant tests: the sum of all escrow balances always equals the
contract's token balance; no escrow ever pays out more than it took in. - Review every cross-contract call for what a hostile token implementation
could do on the callback path.
Acceptance criteria
- Checks-effects-interactions applied to all value paths
- Double-release returns an error and moves no funds
- Balance-conservation invariant asserted in tests
- Adversarial token-contract case considered and documented
Notes
This is the issue an external auditor will look at first. Worth writing the
invariants down before the implementation, not after.
Activity
definurse13 commentedon Aug 24, 2026
Hi Team, I’m a full-stack developer with a strong blockchain background, and I’m confident I can resolve this issue quickly and effectively. I’ll deliver a clean, reliable solution with immediate attention to detail, ensuring it’s completed as soon as possible. Please assign it to me—I’m ready to get started right away.
ETA6hrs.
joelpeace48-cell commentedon Aug 24, 2026
@definurse13 , you are assigned, ensure all ci pipeline passes
grantfox-oss commentedon Aug 24, 2026
🦊 GrantFox — @definurse13 has been assigned to this issue as part of the Third Campaign campaign!
Next steps:
Closes #58)Good luck! Track your progress on GrantFox.
grantfox-oss commentedon Aug 24, 2026
🎉 This issue has been marked as completed on GrantFox as part of the Third Campaign campaign!
@definurse13's PR #86 was approved and merged by @joelpeace48-cell.
🏆 @definurse13: You earned 35 FoxPoints for this contribution! Your current tier: Explorer (48 total points). Track your full progress on GrantFox.
👏 Great work, @definurse13! Keep contributing to FinesseStudioLab.