Prevent maintainers from self-assigning bounties

contracts/README.md

@@ -41,6 +41,7 @@ portable history of paid work.
 | 3 | `NotOpen` | the bounty is already paid or refunded |
 | 4 | `NotAssigned` | `release` called before `assign` |
 | 5 | `AlreadyFunded` | the issue already has an open bounty |
+| 6 | `SelfAssign` | `assign` targets the funding maintainer |
 
 ## Build and test
 

contracts/escrow/src/lib.rs

@@ -44,6 +44,7 @@ pub enum Error {
     NotOpen = 3,
     NotAssigned = 4,
     AlreadyFunded = 5,
+    SelfAssign = 6,
 }
 
 #[contracttype]
@@ -175,6 +176,9 @@ impl Escrow {
     pub fn assign(env: Env, id: u64, assignee: Option<Address>) -> Result<(), Error> {
         let mut bounty = Self::open_bounty(&env, id)?;
         bounty.maintainer.require_auth();
+        if assignee.as_ref() == Some(&bounty.maintainer) {
+            return Err(Error::SelfAssign);
+        }
         bounty.assignee = assignee.clone();
         Self::save(&env, id, &bounty);
         Assigned { id, assignee }.publish(&env);

contracts/escrow/src/test.rs

@@ -98,6 +98,28 @@ fn release_requires_an_assignee() {
     assert_eq!(s.escrow.try_release(&id, &pr), Err(Ok(Error::NotAssigned)));
 }
 
+#[test]
+fn maintainer_cannot_assign_bounty_to_themselves() {
+    let s = setup();
+    let id = s.escrow.fund(&s.maintainer, &s.repo, &842, &900);
+
+    assert_eq!(
+        s.escrow.try_assign(&id, &Some(s.maintainer.clone())),
+        Err(Ok(Error::SelfAssign))
+    );
+    assert_eq!(s.escrow.get(&id).assignee, None);
+}
+
+#[test]
+fn maintainer_can_clear_an_assignee() {
+    let s = setup();
+    let id = s.escrow.fund(&s.maintainer, &s.repo, &842, &900);
+    s.escrow.assign(&id, &Some(s.contributor.clone()));
+    s.escrow.assign(&id, &None);
+
+    assert_eq!(s.escrow.get(&id).assignee, None);
+}
+
 #[test]
 fn closed_bounties_cannot_be_paid_twice() {
     let s = setup();