[Wilfred007]

Problem

A passed Funding proposal in governance had no direct path to move treasury funds. The previous implementation queued a multi-sig withdrawal proposal inside the treasury, which still required signer approvals — meaning a DAO vote alone could never release funds.

Solution

Add a dedicated cross-contract execution path: when a Funding proposal passes and is executed, the governance contract calls treasury.execute_governance_withdrawal() in a single atomic invocation that transfers real tokens to the recipient. No additional treasury signer approval step is involved.

The authorization payload is bound to seven fields — proposal ID, treasury ID, destination, asset, amount, policy version, and expiry — all re-verified against live on-chain state at execution time.

How it works

At finalize time (governance): when a Funding proposal passes quorum, the treasury's current policy_version is snapshotted and a 7-day exec_deadline is set. Any treasury policy change after this point (signer add/remove, threshold change, governance re-registration) invalidates the authorization.

At execute time (governance → treasury): the governance contract calls execute_governance_withdrawal() with the snapshotted payload. The treasury verifies:

• The caller is the registered governance contract
• The treasury ID matches its own address
• The asset matches its bound token
• The policy version matches the current one
• The authorization hasn't expired
• The (governance, proposal_id) pair hasn't been executed before
• Both tracked and real token balances cover the amount

If any check fails, no state changes on either side — the proposal stays Passed and can be retried (unless the deadline has passed).

Security

• No off-chain approval: governance.require_auth() ensures only the governance contract itself can invoke the withdrawal — Soroban enforces this at the host level
• Replay prevention: GovExecuted(governance, proposal_id) stored in treasury persistent storage; failed attempts don't consume it
• Cross-contract misuse: treasury_id must equal env.current_contract_address(), so a payload for treasury A can't be replayed against treasury B
• Stale policy: signer/threshold/governance changes bump policy_version, invalidating any snapshotted authorization
• Real balance check: token_client.balance() is queried before transfer, not just the internal counter
• Atomic execution: token transfer, balance deduction, and receipt write happen in one Soroban invocation — a panic rolls back everything

Changes

Treasury (treasury/src/lib.rs):

• execute_governance_withdrawal() — cross-contract withdrawal entry point
• set_governance() / get_governance() — register/lookup authorized governance contract
• GovernanceWithdrawalReceipt — on-chain audit record per (governance, proposal_id)
• New errors: GovernanceUnauthorized, AssetMismatch, TreasuryMismatch, AuthorizationExpired, AuthorizationReplayed

Governance (governance/src/lib.rs):

• finalize() — snapshots policy_version and sets exec_deadline for passed Funding proposals
• execute_proposal() — calls treasury.execute_governance_withdrawal() for Funding actions
• Proposal struct: added policy_version: u32, exec_deadline: u64
• FUNDING_EXEC_WINDOW constant (7 days)
• get_treasury_config() helper for cross-contract config query

Tests

Test	What it covers
test_funding_proposal_executes_atomic_treasury_withdrawal	Happy path: tokens arrive, balance updates, proposal marked Executed, replay rejected
test_funding_proposal_stale_policy_after_signer_change_fails_atomically	Policy change after passage blocks execution, no tokens move
test_funding_proposal_fails_when_governance_not_registered	Unregistered governance contract rejected
test_funding_proposal_execution_deadline_enforced	Expired authorization rejected
funding_proposal_execution_transfers_atomically (integration)	End-to-end with real token client and receipt verification
funding_proposal_fails_when_governance_not_authorized (integration)	Deny path: no tokens move, proposal stays Passed
funding_proposal_insufficient_treasury_balance_does_not_execute (integration)	Failure atomicity + retry after funding the treasury
funding_proposal_replay_and_cross_contract_misuse_is_rejected (integration)	Replay guard + cross-treasury misuse + per-treasury scoping

Closes #80

[xqcxx]

Reviewed the governance-to-treasury authorization path. The caller, treasury, asset, expiry, policy-version, balance, and replay checks are all enforced before the atomic transfer.