Issues

• Validate registry inputs before the cooldown, extend DeveloperCooldown TTL, and make is_offering_registered total

  priority:mediumsmart-contractsorobanStellar Wavetesting
  Bug

  CalloraOrg/Callora-Contracts#1424 · Filter by author greatest0fallt1me opened on Oct 18, 2026
  3

  

• Replace callora-admin string panics with a typed AdminError, require auth in init, and revive its 62 ignored tests

  priority:mediumrustsmart-contractStellar Wavetesting
  Task

  CalloraOrg/Callora-Contracts#1423 · Filter by author greatest0fallt1me opened on Oct 18, 2026
  4

  

• Move the whitelist from a single instance-storage Vec to per-address persistent entries

  performancepriority:mediumsmart-contractsorobanStellar Wave
  Task

  CalloraOrg/Callora-Contracts#1421 · Filter by author greatest0fallt1me opened on Oct 18, 2026
  3

  

• Add instance TTL management to freeze, checkpoint and the errors registry so emergency controls do not archive

  priority:mediumsmart-contractsorobanStellar Wavetesting
  Task

  CalloraOrg/Callora-Contracts#1420 · Filter by author greatest0fallt1me opened on Oct 18, 2026
  4

  

• Make checkpoint upgrade's migration guard effective (real layout hash, version bump, post-swap finalize)

  priority:mediumsecuritysmart-contractsorobanStellar Wave
  Bug

  CalloraOrg/Callora-Contracts#1419 · Filter by author greatest0fallt1me opened on Oct 18, 2026
  3

  

• Restrict upgrade::check_and_record_upgrade to the stored admin so any signer cannot keep resetting the cooldown

  priority:highsecuritysmart-contractStellar Wavetesting
  Bug

  CalloraOrg/Callora-Contracts#1416 · Filter by author greatest0fallt1me opened on Oct 18, 2026
  3

  

• Require admin auth in CalloraYieldLimits init and gate per-account counter mutation behind a registered operator

  priority:highrustsecuritysmart-contractStellar Wave
  Bug

  CalloraOrg/Callora-Contracts#1414 · Filter by author greatest0fallt1me opened on Oct 18, 2026
  2

  

• Make the hot contract's pause flag actually block rotate_signer and set_cooldown, and add TTL management

  priority:mediumsecuritysmart-contractsorobanStellar Wave
  Bug

  CalloraOrg/Callora-Contracts#1413 · Filter by author greatest0fallt1me opened on Oct 18, 2026
  2

  

• Unify distribute_started / distribute_completed event payloads between distribute and batch_distribute

  observabilitypriority:mediumsmart-contractStellar Wavetesting
  Bug

  CalloraOrg/Callora-Contracts#1409 · Filter by author greatest0fallt1me opened on Oct 18, 2026
  5

  

• Stop refund request_refund from evicting a requester's still-open refunds out of the index

  priority:mediumrustsmart-contractStellar Wavetesting
  Bug

  CalloraOrg/Callora-Contracts#1408 · Filter by author greatest0fallt1me opened on Oct 18, 2026
  3

  

• Make escrow release settle the escrow record and stop overwriting the configured signer

  priority:highsecuritysmart-contractsorobanStellar Wave
  Bug

  CalloraOrg/Callora-Contracts#1406 · Filter by author greatest0fallt1me opened on Oct 18, 2026
  2

  

• Extend settlement instance TTL in init and keep instance lifetime at least as long as persistent balances

  priority:mediumsettlementsmart-contractsorobanStellar Wave
  Bug

  CalloraOrg/Callora-Contracts#1405 · Filter by author greatest0fallt1me opened on Oct 18, 2026
  2

  

• Put revenue_pool upgrade behind a propose/execute/cancel timelock with real storage-layout validation

  priority:highrevenue-poolsecuritysmart-contractStellar Wave
  Feature

  CalloraOrg/Callora-Contracts#1402 · Filter by author greatest0fallt1me opened on Oct 18, 2026
  2

  

• Add expiry to settlement upgrade proposals and clear pending proposals when the admin rotates

  priority:highsecuritysettlementsmart-contractStellar Wave
  Bug

  CalloraOrg/Callora-Contracts#1401 · Filter by author greatest0fallt1me opened on Oct 18, 2026
  4

  

• Make settlement developer-balance pagination O(page) instead of scanning the whole index on every call

  performancepriority:highsettlementsmart-contractStellar Wave
  Task

  CalloraOrg/Callora-Contracts#1400 · Filter by author greatest0fallt1me opened on Oct 18, 2026
  2

  

• Stop the settlement replay high-water mark from being driven by caller-supplied ledger_seq, which permanently blocks developer credits

  priority:highsecuritysettlementsmart-contractStellar Wave
  Bug

  CalloraOrg/Callora-Contracts#1399 · Filter by author greatest0fallt1me opened on Oct 18, 2026
  3

  

• Enforce the vault per-token reserve cap in deposit; set_reserve_cap is stored but never checked

  priority:mediumsecuritysmart-contractStellar Wavevault
  Bug

  CalloraOrg/Callora-Contracts#1394 · Filter by author greatest0fallt1me opened on Oct 18, 2026
  5

  

• Make vault timelock proposal expiry effective, since the clear-on-expiry write is rolled back by the error return

  priority:mediumsmart-contractsorobanStellar Wavevault
  Bug

  CalloraOrg/Callora-Contracts#1393 · Filter by author greatest0fallt1me opened on Oct 18, 2026
  4

  

• Restrict vault distribute to untracked surplus so the admin cannot move depositor-backed USDC without the sweep timelock

  priority:highsecuritysmart-contractStellar Wavevault
  Bug

  CalloraOrg/Callora-Contracts#1392 · Filter by author greatest0fallt1me opened on Oct 18, 2026
  4

  

• Unify vault deduct validation and restore read-only simulate_deduct / simulate_batch_deduct

  priority:highsecuritysmart-contractStellar Wavetesting
  Feature

  CalloraOrg/Callora-Contracts#1389 · Filter by author greatest0fallt1me opened on Oct 18, 2026
  2