[umpireboulianne-design]

Summary

Enforces strict Checks-Effects-Interactions (CEI) ordering and temporary-storage reentrancy locks (DataKey::ReentrancyLock) across RefractPool, RefractBackstop, RefractTreasury, and RefractGrants to prevent cross-contract reentrancy and hostile token callback exploits.

Closes #241

---

Changes

• Pool CEI & Reentrancy Guards (pool/src/lib.rs):
  • Added DataKey::ReentrancyLock and PoolError::ReentrancyDetected = 16.
  • Refactored provide_capital and buy_policy to commit all pool accounting, share, and policy state before invoking token.transfer or RefractPolicyRegistry::register_policy.
  • Guarded provide_capital, withdraw_capital, buy_policy, process_claim, and expire_policy with acquire_reentrancy_guard / release_reentrancy_guard.
• Backstop CEI & Reentrancy Guards (backstop/src/lib.rs, backstop/src/test.rs):
  • Added DataKey::ReentrancyLock and BackstopError::ReentrancyDetected = 13.
  • Refactored deposit_tranche and absorb_loss so all share, asset, lot, and PendingLoss state mutations are persisted before token.transfer.
  • Guarded deposit_tranche, withdraw_tranche, cover_shortfall, absorb_loss, receive_premium, and rescue with acquire_reentrancy_guard / release_reentrancy_guard.
  • Added adversarial token callback tests and legitimate pool -> backstop nested invocation tests in backstop/src/test.rs.
• Treasury CEI & Reentrancy Guards (treasury/src/lib.rs, treasury/src/payments.rs, treasury/src/payments_test.rs):
  • Added DataKey::ReentrancyLock and TreasuryError::ReentrancyDetected = 7.
  • Fixed CEI ordering in execute_payment_request so request.status = PaymentStatus::Executed is persisted before token.transfer.
  • Added adversarial reentrancy test reentrant_payment_execution_during_token_transfer_is_rejected in treasury/src/payments_test.rs.
• Grants CEI & Reentrancy Guards (grants/src/lib.rs, grants/src/contract.rs):
  • Added DataKey::ReentrancyLock and GrantsError::ReentrancyDetected = 20.
  • Fixed CEI ordering in claim and sweep_fees so grant.claimable, milestone claimed flags, and AccruedFees are updated before token.transfer.
  • Added adversarial reentrancy test reentrant_grant_claim_during_token_transfer_is_rejected in grants/src/contract.rs.

Checklist

• Zero new unwrap(), expect(), or panic!() calls in non-test contract code
• Strict Checks-Effects-Interactions (CEI) ordering before external calls
• Adversarial reentrancy and legitimate cross-contract flow tests added