[security] vesting-wallet: initialize doesn't prevent re-initialization

Problem

The initialize function may not prevent re-initialization, allowing the vesting schedule to be overwritten.

Impact

Vesting schedule could be changed after initialization
Beneficiary could be changed
Total amount could be modified

Fix

Add re-initialization guard:

if env.storage().instance().has(&DataKey::Beneficiary) {
    return Err(VestingError::AlreadyInitialized);
}

Location

contracts/vesting-wallet/src/lib.rs, initialize function.

Hello team,

I would like to resolve this issue. Here is my proposed execution plan:

Implementation: Structure Soroban contract handlers for [security] vesting-wallet: initialize doesn't prevent re-initialization following project idioms and storage invariants.
Testing: Add Soroban test cases checking unauthorized invocations, edge values, and state updates.

Happy to pick this up today—please assign to me!

@ejiromowarin

@ejiromowarin has applied to work on this issue as part of the Stellar Wave Program's 9th wave.

Hello, I’d be interested in contributing to this issue and would appreciate the chance to work on it. Thank you for considering my application.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @ejiromowarin to this issue.

@isaacabu221-gif

@isaacabu221-gif has applied to work on this issue as part of the Stellar Wave Program's 9th wave.

Hi maintainer, I’ve reviewed this issue and understand the requirements. I’m ready to implement the fix and submit a PR. I look forward to working with you.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @isaacabu221-gif to this issue.

@Daverisky-max

@Daverisky-max has applied to work on this issue as part of the Stellar Wave Program's 9th wave.

Hi, maintainer I would like to work on this issue, please assign it to me. I’ll start it immediately thanks 🙏

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Daverisky-max to this issue.

@Marshaltechnology

@Marshaltechnology has applied to work on this issue as part of the Stellar Wave Program's 9th wave.

hello maintainer, i want to work on this issue

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Marshaltechnology to this issue.

@Ejvictor4

@Ejvictor4 has applied to work on this issue as part of the Stellar Wave Program's 9th wave.

I'm confident I wan work on this, please assign

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Ejvictor4 to this issue.

@Henrichy

@Henrichy has applied to work on this issue as part of the Stellar Wave Program's 9th wave.

Hi! I'd like to work on this issue.
I've contributed to Rust, TypeScript, backend, frontend, and smart contract projects, with a focus on delivering focused, well-tested changes. I'll keep the implementation within the requested scope, preserve existing behavior unless the issue requires otherwise, include the necessary tests and documentation, and submit a PR that's straightforward to review.
Portfolio: https://portfolio-sandy-alpha-29.vercel.app • ETA: ~2–4 hours.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Henrichy to this issue.

@OlolaJaco

@OlolaJaco has applied to work on this issue as part of the Stellar Wave Program's 9th wave.

I have experience on this

ℹ️ Repo Maintainers: To accept this application, review their application or assign @OlolaJaco to this issue.

@OlolaJaco

Congratulations, @OlolaJaco! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on September 30, 2026.

🧑‍💻 @OlolaJaco: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊

@OlolaJaco

🎉 This issue has been marked as completed on GrantFox!

@OlolaJaco's PR #432 was approved and merged by @ritaifeoluwa.

🏆 @OlolaJaco: You earned 35 FoxPoints for this contribution! Your current tier: Explorer (401 total points). Track your full progress on GrantFox.

👏 Great work, @OlolaJaco! Keep contributing to SmartDropLabs.

@OlolaJaco

This issue has been completed by @OlolaJaco as part of the Stellar Wave Program's 9th Wave 🥳

😎 @OlolaJaco: You earned 200 Points for completing this issue! After the current Wave ends, you'll be eligible for a percentage of the Wave's reward pool based on the percentage of total points you've earned. Learn more here. You can also Leave a review to share your experience working on this issue.

🧑‍💻 Repo maintainers: How'd the contributor do? Leave a review to share your experience working with them.

Navigation Menu

Repository navigation

[security] vesting-wallet: initialize doesn't prevent re-initialization #415

Problem

Impact

Fix

Location

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[security] vesting-wallet: initialize doesn't prevent re-initialization #415

Description

Problem

Impact

Fix

Location

Activity

shobhamerabacha-star commented on Sep 27, 2026

ejiromowarin commented on Sep 27, 2026

isaacabu221-gif commented on Sep 27, 2026

Daverisky-max commented on Sep 27, 2026

Marshaltechnology commented on Sep 27, 2026

Ejvictor4 commented on Sep 27, 2026

Henrichy commented on Sep 27, 2026

OlolaJaco commented on Sep 27, 2026

drips-wave commented on Sep 27, 2026

grantfox-oss commented on Sep 27, 2026

drips-wave commented on Sep 27, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions