[Security] Internal security audit of Soroban contract

[Gbangbolaoluwagbemiga]

Overview

Before mainnet deployment, the contract needs a developer-led security review against this checklist.

Audit checklist

Authorization

• Every state-changing function calls `require_auth()` on the appropriate address
• Admin functions gated to `owner` only
• `approve_milestone` callable only by `depositor` (client)
• `start_work` callable only by `beneficiary` (freelancer)
• `rate_freelancer` callable only post-`Released` state by `depositor`

State machine

• No function allows skipping states
• Completed/Refunded escrows are immutable

Arithmetic

• All `i128` math uses checked operations
• Platform fee calculation can't overflow
• Zero-amount milestones handled

Token handling

• Only whitelisted tokens accepted
• No residual token balance after all milestones settle
• Native XLM and SAC paths both tested

DoS

• Unbounded `Vec` inputs have max length enforcement
• Milestone count can't exhaust ledger entry limits

Output

Post a short audit report as a comment: ✅ passes, ⚠️ findings with severity + fix recommendation.

References

• Soroban Security Best Practices