Skip to content

Add tokens.rs decimals self-test verifying the SAC reported decimals on registry #678

Description

@greatest0fallt1me

Description

When admins register a new SAC token, the on-chain registry trusts the declared decimals without verifying them. Add a self-test that calls the SAC's decimals() and rejects registration if the declared value does not match, preventing denomination mistakes that have caused real on-chain losses on other Stellar protocols.

Requirements and Context

  • Cross-contract call inside tokens.rs
  • Mismatch returns Error::TokenDecimalsMismatch
  • Self-test runs on every register and on a manual re_verify_token admin entrypoint
  • Must be secure, tested, and documented
  • Should be efficient and easy to review

Suggested Execution

  1. Fork the repo and create a branch
    git checkout -b feature/token-decimals-self-test
  2. Implement changes
    • contracts/predictify-hybrid/src/tokens.rs
    • contracts/predictify-hybrid/src/custom_token_tests.rs
  3. Test and commit
    • cargo test -p predictify-hybrid token_decimals_self_test
    • Cover edge cases
    • Include test output and notes in the PR

Example commit message

feat: verify SAC decimals on token registration

Acceptance Criteria

  • Mismatch rejected with specific error
  • re_verify_token is admin-gated
  • Test uses a mock SAC with mis-declared decimals

Guidelines

  • Validate auth, overflow, and storage TTL/archival
  • Clear documentation and inline comments
  • Timeframe: 96 hours

Metadata

Metadata

Assignees

Labels

GRANTFOX OSSGrantFox open-source campaign taskOFFICIAL CAMPAIGNOfficial GrantFox campaign issueStellar WaveIssues in the Stellar wave programrustRust implementationsecuritySecurity hardeningsmart-contractSoroban smart-contract worksorobanSoroban SDK / Stellar

Type

No type
No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions