Cap reputation_bump per award (events) and delta per call (profile)

[0xdevcollins]

Source: docs/threat-model.md v1.0, EoP.15 (Priority 2, Open).

Problem

WinnerSpec.reputation_bump (contracts/events/src/types.rs:150) and the reputation_bump argument of claim_milestone are u32 values chosen by the manager or owner and forwarded unchecked to profile.bump_reputation, which does saturating_add(delta as u64) (contracts/profile/src/reputation.rs:22). The profile contract only checks that the caller is the events contract. Nothing relates the bump to the award or bounds it, so the reputation score has no integrity guarantee.

Change

• Events side: MAX_REPUTATION_BUMP constant (or per-event config on EventRecord at the next migration, per the per-event-configuration rule) enforced in select_winners and claim_milestone
• Profile side: MAX_DELTA_PER_CALL enforced in bump_reputation / slash_reputation as defence in depth
• Tests: over-cap bump rejected on both sides

[abojeEdwin]

Hi maintainer, I've gone through the issue and I have a clear understanding of the fix for this issue. I'd love to be assigned to this issue. Thank you

[Okorie2000-code]

The issue description is crystal clear, and I’d be glad to work on it. I’ll ensure the implementation is clean, tested, and submit a clean PR. Kindly assign it to me. 🙏

[guptakumarranjeet150]

Hey team,

I am interested in working on this issue.
Plan:

1. Structure Soroban contract handlers for Cap reputation_bump per award (events) and delta per call (profile) following project idioms and storage invariants.
2. Cover contract calls with hermetic unit tests verifying events and token balances.

Happy to pick this up today—please assign to me!