Issues

• Audit readiness: STRIDE threat model v1.0 open items (tracking)

  contractcritical-pathowner-contractsecurity
  boundlessfi/boundless-contract#143 · Filter by author 0xdevcollins opened on Sep 12, 2026 · M4 Audit readiness — contract 1.8.0
  10

• Align contracts/events/Cargo.toml version with contractmeta (1.6.0 → 1.7.0)

  contractowner-contract
  boundlessfi/boundless-contract#142 · Filter by author 0xdevcollins opened on Sep 12, 2026 · M3 Mainnet 1.7.0
  5

• Runbook: verify the fee account holds a trustline before registering a token or rotating the fee account

  documentationowner-contractseverity: low
  boundlessfi/boundless-contract#141 · Filter by author 0xdevcollins opened on Sep 12, 2026 · M4 Audit readiness — contract 1.8.0
  5

• Dedicated validator role for crowdfunding milestone co-authorization (admin quorum is used today)

  contractenhancementowner-contractsecurityseverity: medium
  boundlessfi/boundless-contract#140 · Filter by author 0xdevcollins opened on Sep 12, 2026 · M5 Audit decisions
  4

• unpause: extend time-based windows by the pause duration

  contractenhancementowner-contractseverity: medium
  boundlessfi/boundless-contract#139 · Filter by author 0xdevcollins opened on Sep 12, 2026 · M4 Audit readiness — contract 1.8.0
  6

• Event schema: per-award, cancellation-started, and zero-refund events

  contractenhancementowner-contract
  boundlessfi/boundless-contract#138 · Filter by author 0xdevcollins opened on Sep 12, 2026 · M4 Audit readiness — contract 1.8.0
  5

• propose_manager: emit a cancellation event when replacing a pending proposal

  contractenhancementowner-contractseverity: low
  boundlessfi/boundless-contract#137 · Filter by author 0xdevcollins opened on Sep 12, 2026 · M4 Audit readiness — contract 1.8.0
  5

• process_cancel_batch: reject max_refunds == 0

  contractowner-contractseverity: low
  boundlessfi/boundless-contract#136 · Filter by author 0xdevcollins opened on Sep 12, 2026 · M4 Audit readiness — contract 1.8.0
  3

• claim_milestone: record the claim before transferring, matching claim_prize

  contractowner-contractseverity: low
  boundlessfi/boundless-contract#135 · Filter by author 0xdevcollins opened on Sep 12, 2026 · M4 Audit readiness — contract 1.8.0
  3

• select_winners: use saturating arithmetic for the anchor index (Scout finding)

  contractowner-contractseverity: low
  boundlessfi/boundless-contract#134 · Filter by author 0xdevcollins opened on Sep 12, 2026 · M4 Audit readiness — contract 1.8.0
  4

• Cap reputation_bump per award (events) and delta per call (profile)

  contractowner-contractsecurityseverity: medium
  boundlessfi/boundless-contract#133 · Filter by author 0xdevcollins opened on Sep 12, 2026 · M4 Audit readiness — contract 1.8.0
  4

• Grant submissions are unreachable: add a grant application path or reject grants in submit explicitly

  bugcontractowner-contractseverity: medium
  boundlessfi/boundless-contract#132 · Filter by author 0xdevcollins opened on Sep 12, 2026 · M4 Audit readiness — contract 1.8.0
  4

• submit: refuse writes to a slot once a selection exists; record last update time

  contractowner-contractseverity: medium
  boundlessfi/boundless-contract#131 · Filter by author 0xdevcollins opened on Sep 12, 2026 · M4 Audit readiness — contract 1.8.0
  4

• select_winners: reject duplicate recipients within a multi-release selection

  contractowner-contractseverity: low
  boundlessfi/boundless-contract#130 · Filter by author 0xdevcollins opened on Sep 12, 2026 · M4 Audit readiness — contract 1.8.0
  4

• Bind child op_ids to the authorizing address

  contractowner-contractsecurityseverity: low
  boundlessfi/boundless-contract#129 · Filter by author 0xdevcollins opened on Sep 12, 2026 · M4 Audit readiness — contract 1.8.0
  5

• Make the profile calls in apply_to_bounty and claim_milestone best-effort (try_ variants)

  contractenhancementowner-contractseverity: medium
  boundlessfi/boundless-contract#128 · Filter by author 0xdevcollins opened on Sep 12, 2026 · M4 Audit readiness — contract 1.8.0
  2

• start_cancel: extend the claimable-prize guard to multi-release awards with unpaid milestones

  contractowner-contractsecurityseverity: high
  boundlessfi/boundless-contract#127 · Filter by author 0xdevcollins opened on Sep 12, 2026 · M5 Audit decisions
  4

• process_cancel_batch: a refund transfer that cannot complete blocks the whole cancellation

  contractowner-contractsecurityseverity: high
  boundlessfi/boundless-contract#126 · Filter by author 0xdevcollins opened on Sep 12, 2026 · M5 Audit decisions
  3

• Recovery path when an accepted event manager's key is lost

  contractenhancementowner-contractsecurityseverity: high
  boundlessfi/boundless-contract#125 · Filter by author 0xdevcollins opened on Sep 12, 2026 · M5 Audit decisions
  3

• Finish the 1.7.0 mainnet migration: run migrate_events + migrate on events, migrate on profile, record the apply

  contractcritical-pathdocumentationowner-contractsecurityseverity: high
  boundlessfi/boundless-contract#124 · Filter by author 0xdevcollins opened on Sep 12, 2026 · M3 Mainnet 1.7.0
  3

• Restore the upgrade timelock to 17,280 ledgers on both contracts (live escrow under a zero timelock)

  contractcritical-pathowner-contractsecurityseverity: high
  boundlessfi/boundless-contract#123 · Filter by author 0xdevcollins opened on Sep 12, 2026 · M3 Mainnet 1.7.0
  3