Issues

• allocations map retains released issues — phantom ledger drift

  MergeFi/contracts#608 · Filter by author yggdrasilworld opened on Oct 14, 2026
  2

• escrow::contribute and milestones::contribute accept new funds after deadline + GRACE_PERIOD, when anyone can already refund or cancel

  bug
  MergeFi/contracts#568 · Filter by author chonilius opened on Oct 13, 2026
  1

• Makefile deploy targets deploy the unoptimised .wasm — stellar contract optimize writes *.optimized.wasm

  buggood first issue
  MergeFi/contracts#567 · Filter by author chonilius opened on Oct 13, 2026
  1

• keep_alive never refreshes instance storage, so a contract kept alive only via keep_alive can still archive Admin/Oracle/Treasury

  bug
  MergeFi/contracts#566 · Filter by author chonilius opened on Oct 13, 2026
  1

• [Regression on closed #254] milestones::deallocate still has no test asserting admin authorization

  securitytesting
  MergeFi/contracts#565 · Filter by author chonilius opened on Oct 13, 2026
  1

• [Regression on closed #316] maintenance-pool::reclaim_deposit still has no test asserting the sponsor's own authorization

  securitytesting
  MergeFi/contracts#564 · Filter by author chonilius opened on Oct 13, 2026
  1

• [Regression on closed #315] maintenance-pool::recover_admin's only test still runs under mock_all_auths()

  securitytesting
  MergeFi/contracts#563 · Filter by author chonilius opened on Oct 13, 2026
  1

• [Regression on closed #314] milestones::recover_admin's only test still runs under mock_all_auths()

  securitytesting
  MergeFi/contracts#562 · Filter by author chonilius opened on Oct 13, 2026
  1

• maintenance-pool::set_treasury has no test proving it requires the admin's authorization

  securitytesting
  MergeFi/contracts#561 · Filter by author chonilius opened on Oct 13, 2026
  1

• maintenance-pool::deposit has no test proving it requires the sponsor's authorization

  securitytesting
  MergeFi/contracts#560 · Filter by author chonilius opened on Oct 13, 2026
  1

• maintenance-pool::pause has no test proving it requires the admin's authorization

  securitytesting
  MergeFi/contracts#559 · Filter by author chonilius opened on Oct 13, 2026
  1

• maintenance-pool::sweep has no test proving it requires the admin's authorization

  securitytesting
  MergeFi/contracts#558 · Filter by author chonilius opened on Oct 13, 2026
  1

• maintenance-pool::withdraw has no test proving it requires the oracle's authorization

  securitytesting
  MergeFi/contracts#557 · Filter by author chonilius opened on Oct 13, 2026
  1

• milestones::set_treasury has no test proving it requires the admin's authorization

  securitytesting
  MergeFi/contracts#556 · Filter by author chonilius opened on Oct 13, 2026
  1

• [Regression on closed #29] maintenance-pool still has no long-run invariant fuzz test

  testing
  MergeFi/contracts#538 · Filter by author chonilius opened on Oct 13, 2026
  1

• [Regression on closed #330] scripts/lib/submit.mjs still has no test file

  good first issueStellar Wavetesting
  MergeFi/contracts#537 · Filter by author chonilius opened on Oct 13, 2026
  4

  

• maintenance-pool: MAX_DEPOSITS is a lifetime cap that anyone can exhaust with 50 one-stroop deposits, bricking the pool

  bugsecurityStellar Wave
  MergeFi/contracts#533 · Filter by author chonilius opened on Oct 13, 2026
  5

  

• maintenance-pool::deposit credits the requested amount, not the amount received (no measure_transfer_delta)

  bugsecurityStellar Wave
  MergeFi/contracts#532 · Filter by author chonilius opened on Oct 13, 2026
  4

  

• docs/pause-circuit-breaker-design.md lists ContractPaused = 30 and an is_paused getter — the code uses 19/18/13 and is_paused_view

  documentationgood first issueStellar Wave
  MergeFi/contracts#529 · Filter by author chonilius opened on Oct 13, 2026
  3

  

• No reproducible-build / supply-chain verification — deployed testnet WASM hash cannot be independently confirmed against published source

  documentationGrantFox OSSMaybe RewardedOfficial Campaign | FWC26securityThird Campaignvery hard
  MergeFi/contracts#59 · Filter by author chonilius opened on Aug 16, 2026
  2

  

• All three contracts: fee_bps is read fresh at payout time, not snapshotted at deposit — #20's mutable-fee design would enable retroactive fee changes

  architectureGrantFox OSSMaybe RewardedOfficial Campaign | FWC26securityThird Campaignvery hard
  MergeFi/contracts#53 · Filter by author chonilius opened on Aug 16, 2026
  2

  

• milestones::allocate: issue_id uniqueness is only enforced within a single milestone_id — the same GitHub issue can be paid out from multiple milestones

  bugGrantFox OSSMaybe RewardedOfficial Campaign | FWC26securityThird Campaignvery hard
  MergeFi/contracts#51 · Filter by author chonilius opened on Aug 16, 2026
  4

  

• escrow: dead NotExpired/InsufficientBalance error variants suggest a missing defensive balance check in release()/refund()

  bugGrantFox OSSMaybe RewardedOfficial Campaign | FWC26testingThird Campaignvery hard
  MergeFi/contracts#48 · Filter by author chonilius opened on Aug 16, 2026
  2

  

• All three contracts: fee_bps has no sanity ceiling below 10000 (100%) — a valid-but-predatory full-fee config silently zeros every payout

  bugGrantFox OSSMaybe RewardedOfficial Campaign | FWC26securityThird Campaignvery hard
  MergeFi/contracts#40 · Filter by author chonilius opened on Aug 16, 2026
  2

  

• Migrate initialize to a Soroban constructor to close the deploy/init front-running race

  documentationGrantFox OSSMaybe RewardedOfficial Campaign | FWC26spike
  MergeFi/contracts#33 · Filter by author miraclesonly opened on Jul 20, 2026
  9