[manaifae]

Summary

fix: address #266, #267, #268, #269

What was solved

#266 — SEC-28: Harden emergency drain with two-step proposal and time-lock

Add a 24-hour time-lock between propose_emergency_drain and emergency_drain in the stream contract: record the proposal timestamp, reject execution before 86_400 seconds elapse with a new ERR_DRAIN_TIMELOCK_ACTIVE error, add unit tests for both the too-early panic and the post-delay success, and update the emergency-drain security doc.

Addressed:

• Changed: docs/security/emergency-drain.md, contracts/stream/src/storage.rs
• propose_emergency_drain must record the proposal timestamp in contract storage
• emergency_drain must reject execution if fewer than 86_400 seconds have elapsed since the proposal
• Add new error constant ERR_DRAIN_TIMELOCK_ACTIVE

#267 — SEC-29: Add cargo-audit step to CI for known CVE detection

Add a cargo-audit CI step to the existing audit.yml workflow so RustSec advisories are checked on every push, failing on high/critical CVEs, with the advisory DB refreshed each run. Also update comments in deny.toml and audit.yml to clarify the division of responsibility between cargo-deny (licenses/bans) and cargo-audit (CVEs).

Addressed:

• Changed: .github/workflows/audit.yml, deny.toml, .github/workflows/deny.yml
• Add cargo audit invocation to .github/workflows/audit.yml
• Workflow must fail on any high/critical CVE (use cargo-audit severity/deny flags or equivalent)
• Ensure the RustSec advisory database is updated on every run (not cached)

#268 — SEC-30: Implement admin multi-sig requirement for mainnet

Document the mainnet admin multi-sig requirement (2-of-3 signers) in docs/security/admin-multisig.md, including setup steps, an onboarding checklist (create multisig, transfer admin, verify on-chain), an operations runbook with multisig signing steps for all admin calls, and testnet verification before mainnet. This is a documentation-focused security task; the referenced file docs/security/admin-multisig.md is not present in the provided file tree, so it must be created/updated as the primary deliverable.

Addressed:

• Changed: docs/security/admin-multisig.md, docs/security/operations-runbook.md, SECURITY.md
• Update/create docs/security/admin-multisig.md with mainnet-specific setup steps
• Require a minimum 2-of-3 signer multisig (Stellar native multisig or deployed multisig contract)
• Provide onboarding checklist: create multisig account, transfer admin, verify transfer on-chain

#269 — SEC-31: Add semantic versioning check to prevent WASM downgrade

Add a version-downgrade guard to the stream contract's migrate entrypoint: read the stored DataKey::Version, panic with a new ERR_VERSION_DOWNGRADE error when the incoming CONTRACT_VERSION is less than or equal to the stored version, add unit tests for downgrade and same-version attempts, and document the version-increment requirement in the upgrade guide.

Addressed:

• Changed: contracts/stream/src/storage.rs
• migrate must read stored DataKey::Version and panic if the new CONTRACT_VERSION <= stored version
• Add new error constant ERR_VERSION_DOWNGRADE
• Add unit test asserting a downgrade attempt panics

Changes

• docs/security/emergency-drain.md (modify)
• .github/workflows/audit.yml (modify)
• docs/security/admin-multisig.md (modify)
• contracts/stream/src/storage.rs (modify)
• .github/workflows/deny.yml (modify)
• SECURITY.md (modify)
• deny.toml (modify)
• docs/security/operations-runbook.md (create)

Approach

1. SEC-28: Harden emergency drain with two-step proposal and time-lock #266 — SEC-28: Harden emergency drain with two-step proposal and time-lock (Changed: docs/security/emergency-drain.md, contracts/stream/src/storage.rs)
2. SEC-29: Add cargo-audit step to CI for known CVE detection #267 — SEC-29: Add cargo-audit step to CI for known CVE detection (Changed: .github/workflows/audit.yml, deny.toml, .github/workflows/deny.yml)
3. SEC-30: Implement admin multi-sig requirement for mainnet #268 — SEC-30: Implement admin multi-sig requirement for mainnet (Changed: docs/security/admin-multisig.md, docs/security/operations-runbook.md, SECURITY.md)
4. SEC-31: Add semantic versioning check to prevent WASM downgrade #269 — SEC-31: Add semantic versioning check to prevent WASM downgrade (Changed: contracts/stream/src/storage.rs)

Issues

Closes #266
Closes #267
Closes #268
Closes #269

[drips-wave]

@manaifae Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits