Issues

• Validate registry inputs before the cooldown, extend DeveloperCooldown TTL, and make is_offering_registered total

  priority:mediumsmart-contractsorobanStellar Wavetesting
  Bug

  CalloraOrg/Callora-Contracts#1424 · Filter by author greatest0fallt1me opened on Oct 18, 2026
  3

  

• Replace callora-admin string panics with a typed AdminError, require auth in init, and revive its 62 ignored tests

  priority:mediumrustsmart-contractStellar Wavetesting
  Task

  CalloraOrg/Callora-Contracts#1423 · Filter by author greatest0fallt1me opened on Oct 18, 2026
  4

  

• Move the whitelist from a single instance-storage Vec to per-address persistent entries

  performancepriority:mediumsmart-contractsorobanStellar Wave
  Task

  CalloraOrg/Callora-Contracts#1421 · Filter by author greatest0fallt1me opened on Oct 18, 2026
  3

  

• Make fee deposit and withdraw move real tokens, and stop any address from inflating accumulated fees

  priority:highrustsecuritysmart-contractStellar Wave
  Bug

  CalloraOrg/Callora-Contracts#1417 · Filter by author greatest0fallt1me opened on Oct 18, 2026
  7

  

• Restrict upgrade::check_and_record_upgrade to the stored admin so any signer cannot keep resetting the cooldown

  priority:highsecuritysmart-contractStellar Wavetesting
  Bug

  CalloraOrg/Callora-Contracts#1416 · Filter by author greatest0fallt1me opened on Oct 18, 2026
  3

  

• Make the hot contract's pause flag actually block rotate_signer and set_cooldown, and add TTL management

  priority:mediumsecuritysmart-contractsorobanStellar Wave
  Bug

  CalloraOrg/Callora-Contracts#1413 · Filter by author greatest0fallt1me opened on Oct 18, 2026
  2

  

• Unify distribute_started / distribute_completed event payloads between distribute and batch_distribute

  observabilitypriority:mediumsmart-contractStellar Wavetesting
  Bug

  CalloraOrg/Callora-Contracts#1409 · Filter by author greatest0fallt1me opened on Oct 18, 2026
  7

  

• Make settlement TotalReceived match its documentation and expose unallocated vault deductions

  observabilitypriority:mediumsettlementsmart-contractStellar Wave
  Bug

  CalloraOrg/Callora-Contracts#1404 · Filter by author greatest0fallt1me opened on Oct 18, 2026
  7

  

• Put revenue_pool upgrade behind a propose/execute/cancel timelock with real storage-layout validation

  priority:highrevenue-poolsecuritysmart-contractStellar Wave
  Feature

  CalloraOrg/Callora-Contracts#1402 · Filter by author greatest0fallt1me opened on Oct 18, 2026
  2

  

• Add expiry to settlement upgrade proposals and clear pending proposals when the admin rotates

  priority:highsecuritysettlementsmart-contractStellar Wave
  Bug

  CalloraOrg/Callora-Contracts#1401 · Filter by author greatest0fallt1me opened on Oct 18, 2026
  4

  

• Stop the settlement replay high-water mark from being driven by caller-supplied ledger_seq, which permanently blocks developer credits

  priority:highsecuritysettlementsmart-contractStellar Wave
  Bug

  CalloraOrg/Callora-Contracts#1399 · Filter by author greatest0fallt1me opened on Oct 18, 2026
  3

  

• Emit request_id in vault deduct events as EVENT_SCHEMA.md promises

  observabilitypriority:mediumsmart-contractStellar Wavevault
  Bug

  CalloraOrg/Callora-Contracts#1397 · Filter by author greatest0fallt1me opened on Oct 18, 2026
  9

  

• Enforce the vault per-token reserve cap in deposit; set_reserve_cap is stored but never checked

  priority:mediumsecuritysmart-contractStellar Wavevault
  Bug

  CalloraOrg/Callora-Contracts#1394 · Filter by author greatest0fallt1me opened on Oct 18, 2026
  5

  

• Restrict vault distribute to untracked surplus so the admin cannot move depositor-backed USDC without the sweep timelock

  priority:highsecuritysmart-contractStellar Wavevault
  Bug

  CalloraOrg/Callora-Contracts#1392 · Filter by author greatest0fallt1me opened on Oct 18, 2026
  4