Skip to content

escrow::contribute and milestones::contribute accept new funds after deadline + GRACE_PERIOD, when anyone can already refund or cancel #568

New issue
New issue
Open
#763
#571
Open
escrow::contribute and milestones::contribute accept new funds after deadline + GRACE_PERIOD, when anyone can already refund or cancel#568
#763
#571
Labels
bugSomething isn't working

Description

@chonilius
chonilius
opened on Oct 13, 2026

Problem

Neither contribute checks the deadline. Once now >= deadline + GRACE_PERIOD, escrow's refund and milestones' cancel_milestone_after_deadline are permissionless, yet both contracts still take new contributions. A late sponsor's tokens go into an escrow or milestone that's already in its wind-down window: they can be refunded (or pro-rata redistributed, for milestones) by any third party in the next transaction, and the sponsor pays fees for a contribution that can never fund work.

Suggested fix

Reject contribute with InvalidDeadline (or a new DeadlinePassed) once now >= deadline, and test both contracts.

Related: #49, #56

Activity

  1. chonilius
    added
    bugSomething isn't working
    Stellar WaveIssues in the Stellar wave program
    on Oct 13, 2026

  2. urielit1313-creator commented on Oct 13, 2026

    @urielit1313-creator
    urielit1313-creator
    on Oct 13, 2026

    Submitted PR #571 resolving this issue across both escrow and milestones.

    Details

    • In escrow::contribute, reject calls with Error::InvalidDeadline if env.ledger().timestamp() >= escrow.deadline.
    • In milestones::contribute, reject calls with Error::InvalidDeadline if env.ledger().timestamp() >= milestone.deadline.
    • Added InvalidDeadline = 22 to milestones::Error.
    • Added unit tests in both crates verifying rejection at the exact deadline timestamp, past the deadline, and past the grace period, while verifying valid contributions succeed prior to the deadline.
    • 181/181 workspace tests passing with 0 warnings.

    Payout Address (Base USDC):
    0xfE777c43e4B0A24fFA1527eD520d1E7f9ECED483

  3. chonilius
    removed
    Stellar WaveIssues in the Stellar wave program
    on Oct 15, 2026

  4. huangji6693-max commented on Oct 26, 2026

    @huangji6693-max
    huangji6693-max
    on Oct 26, 2026

    Submitted PR #763 rejecting escrow::contribute with Error::InvalidDeadline and milestones::contribute with Error::DeadlinePassed once now >= deadline, with regression unit tests for both contracts: #763

  5. ranjeet150 commented on Oct 26, 2026

    @ranjeet150
    ranjeet150
    on Oct 26, 2026

    Hello,

    I am interested in taking up "escrow::contribute and milestones::contribute accept new funds after deadline + GRACE_PERIOD, when anyone can already refund or cancel" and implementing a production-grade solution.

    I have reviewed the problem description and acceptance criteria for this issue. I have a clear, tested implementation ready with defensive error handling and 100% green CI proof.

    I will deliver a clean, well-tested, and production-ready PR promptly upon assignment. Kindly assign this issue to me.

    Thank you!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions