[umpireboulianne-design]

Summary

Implements anonymity-preserving payout-address indirection on RefractBountyEscrow so researchers can claim bounties without permanently linking their disclosure identity to their payout wallet on-chain.

Closes #238

---

Changes

• Commitment-Bound Disclosures & Adjudication (bounty/src/lib.rs):
  • compute_commitment(preimage): computes SHA-256(preimage) for 32-byte secret preimages.
  • submit_disclosure(submitter, report_hash, commitment): binds a vulnerability disclosure report_hash to a payout commitment instead of the submitter's funding address, rejecting duplicate reports and commitment reuse across reports (BountyError::CommitmentAlreadyUsed).
  • award_commitment(caller, report_hash, commitment, amount): governance-gated entrypoint that adjudicates a report against its commitment and reserves amount in the CommitmentAwardStatus::Awarded state without exposing the destination wallet.
• Front-Running-Resistant Payout Binding & Rotation (bounty/src/lib.rs):
  • register_payout_address(owner, preimage, payout_address): requires preimage at registration to prevent front-running, stores PayoutBindingRecord in persistent storage with explicit TTL extension (extend_ttl) and bounded lifetime (DEFAULT_BINDING_TTL_SECS), and emits p_reg.
  • rotate_payout_address(owner, preimage, new_payout_address): allows the binding owner to rotate the payout destination prior to claim, atomically revoking the previous payout address so two addresses can never claim the same award, and emits p_rotate.
• Preimage-Verified Claim & Compromised-Address Freeze (bounty/src/lib.rs):
  • claim_by_commitment(caller, preimage): verifies the preimage, checks binding ownership/TTL/freeze state, transitions the award from Awarded to Claimed, releases the reservation, transfers the reward to the bound payout_address, and emits c_claim.
  • freeze_payout_address(caller, address, frozen): governance-gated entrypoint to freeze or unfreeze a compromised payout address without altering the awarded reward amount (allowing the binding owner to rotate to a clean address before claiming). By design, lost keys/preimages are an unrecoverable loss with no admin redirect override.
• Documentation (SECURITY.md, bounty/src/lib.rs):
  • Documented the commitment registration, adjudication, rotation, freeze, claim, and lost-key semantics in both SECURITY.md and the crate-level rustdoc.
• Unit Tests (bounty/src/test.rs):
  • indirection_register_award_rotate_claim_happy_path
  • indirection_double_claim_rejected
  • indirection_commitment_reuse_rejected
  • indirection_claim_with_wrong_preimage_rejected
  • indirection_rotation_by_non_owner_rejected
  • indirection_binding_ttl_expiry_rejected
  • indirection_freeze_compromised_payout_address_preserves_reward_and_allows_rotation

Checklist

• Zero unwrap(), expect(), or panic!() calls in non-test contract code
• Persistent storage entries extended with explicit TTLs
• SECURITY.md and crate documentation updated