Issues

• No reproducible-build / supply-chain verification — deployed testnet WASM hash cannot be independently confirmed against published source

  documentationGrantFox OSSMaybe RewardedOfficial Campaign | FWC26securityThird Campaignvery hard
  MergeFi/contracts#59 · Filter by author chonilius opened on Aug 16, 2026
  2

  

• All three contracts: fee_bps is read fresh at payout time, not snapshotted at deposit — #20's mutable-fee design would enable retroactive fee changes

  architectureGrantFox OSSMaybe RewardedOfficial Campaign | FWC26securityThird Campaignvery hard
  MergeFi/contracts#53 · Filter by author chonilius opened on Aug 16, 2026
  2

  

• milestones::allocate: issue_id uniqueness is only enforced within a single milestone_id — the same GitHub issue can be paid out from multiple milestones

  bugGrantFox OSSMaybe RewardedOfficial Campaign | FWC26securityThird Campaignvery hard
  MergeFi/contracts#51 · Filter by author chonilius opened on Aug 16, 2026
  4

  

• escrow: dead NotExpired/InsufficientBalance error variants suggest a missing defensive balance check in release()/refund()

  bugGrantFox OSSMaybe RewardedOfficial Campaign | FWC26testingThird Campaignvery hard
  MergeFi/contracts#48 · Filter by author chonilius opened on Aug 16, 2026
  2

  

• All three contracts: fee_bps has no sanity ceiling below 10000 (100%) — a valid-but-predatory full-fee config silently zeros every payout

  bugGrantFox OSSMaybe RewardedOfficial Campaign | FWC26securityThird Campaignvery hard
  MergeFi/contracts#40 · Filter by author chonilius opened on Aug 16, 2026
  2

  

• Migrate initialize to a Soroban constructor to close the deploy/init front-running race

  documentationGrantFox OSSMaybe RewardedOfficial Campaign | FWC26spike
  MergeFi/contracts#33 · Filter by author miraclesonly opened on Jul 20, 2026
  9

  

• Build a Soroban instruction/resource-budget regression benchmark suite for all entrypoints

  GrantFox OSSMaybe RewardedOfficial Campaign | FWC26performanceStellar Wavetestingvery hard
  MergeFi/contracts#23 · Filter by author chonilius opened on Jul 15, 2026
  4

  

• Unvalidated deadline in escrow::fund — analyze and guard against degenerate/past-dated deadlines

  bugGrantFox OSSMaybe RewardedOfficial Campaign | FWC26securityStellar Wavevery hard
  MergeFi/contracts#21 · Filter by author chonilius opened on Jul 15, 2026
  4

  

• Extract compute_split into a shared crate with proof of behavioral equivalence

  architectureenhancementGrantFox OSSMaybe RewardedOfficial Campaign | FWC26Stellar Wavetestingvery hard
  MergeFi/contracts#16 · Filter by author chonilius opened on Jul 15, 2026
  8

  

• Fixed TTL extension thresholds risk archival/fund-inaccessibility for long-lived escrows and pools

  architecturebugGrantFox OSSMaybe RewardedOfficial Campaign | FWC26Stellar Wavevery hard
  MergeFi/contracts#11 · Filter by author chonilius opened on Jul 15, 2026
  9

  

• Maintenance-pool deposit() allows pool-id squatting via TokenMismatch griefing

  bugGrantFox OSSMaybe RewardedOfficial Campaign | FWC26securityStellar Wavevery hard
  MergeFi/contracts#2 · Filter by author chonilius opened on Jul 15, 2026
  4

  

• Escrow fund() allows issue-id griefing via front-running before the legitimate sponsor funds

  bugGrantFox OSSMaybe RewardedOfficial Campaign | FWC26securityStellar Wavevery hard
  MergeFi/contracts#1 · Filter by author chonilius opened on Jul 15, 2026
  5