From c0c08ef2b1b5d304d89ca8bc148d7f4d9fd8d04f Mon Sep 17 00:00:00 2001 From: mnwoye Date: Mon, 31 Aug 2026 13:00:19 +0100 Subject: [PATCH 1/3] resource and rate limits --- TODO.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/TODO.md b/TODO.md index dc8140c79..c841f6660 100644 --- a/TODO.md +++ b/TODO.md @@ -21,3 +21,7 @@ - [ ] Run `cargo test -p quicklendx-contracts --lib` to verify all 9 tests pass - [ ] Run `cargo clippy --workspace --all-targets -- -D warnings` + + + + From ea37a4dec7e71cdb0abf65a5d5e0378c31504aaa Mon Sep 17 00:00:00 2001 From: mnwoye Date: Mon, 31 Aug 2026 13:11:09 +0100 Subject: [PATCH 2/3] feat:replay and idempotency --- TEST_OUTPUT.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/TEST_OUTPUT.md b/TEST_OUTPUT.md index 3d0701543..c4cad0cdb 100644 --- a/TEST_OUTPUT.md +++ b/TEST_OUTPUT.md @@ -24,3 +24,5 @@ When validating limits, specifically boundaries, off-by-one errors frequently ha - **Invoice Amount**: Prevented an off-by-one vulnerability where `min_invoice_amount` check in `admin.rs` and `init.rs` only validated `cfg.min_invoice_amount == 0`. It was fixed to `cfg.min_invoice_amount <= 0` to properly reject negative invalid bounds. - **Due Date**: The `max_due_date_days` has been rigorously verified to allow exactly `730` but fail securely at `731`. - **Business Capacity**: Validated the `max_invoices_per_business` boundary. For a limit $N$, the protocol properly permits the $N^{th}$ creation and completely blocks the $(N+1)^{th}$ creation, preventing state exhaustion. + + From 4e3871dabc5b9c7009e8fbc88461e7529e88a02c Mon Sep 17 00:00:00 2001 From: mnwoye Date: Mon, 31 Aug 2026 13:14:39 +0100 Subject: [PATCH 3/3] feat:concurrency and race safety --- TEST_OUTPUT.md | 1 - 1 file changed, 1 deletion(-) diff --git a/TEST_OUTPUT.md b/TEST_OUTPUT.md index c4cad0cdb..73448d9ea 100644 --- a/TEST_OUTPUT.md +++ b/TEST_OUTPUT.md @@ -25,4 +25,3 @@ When validating limits, specifically boundaries, off-by-one errors frequently ha - **Due Date**: The `max_due_date_days` has been rigorously verified to allow exactly `730` but fail securely at `731`. - **Business Capacity**: Validated the `max_invoices_per_business` boundary. For a limit $N$, the protocol properly permits the $N^{th}$ creation and completely blocks the $(N+1)^{th}$ creation, preventing state exhaustion. -