Skip to content

Add a regression proving an unverified investor cannot have a bid accepted even if place_bid succeeded earlierΒ #1742

Description

@Baskarayelu

πŸ“‹ Description

Investor KYC is enforced via is_investor_verified in verification.rs, and bid acceptance funds escrow through accept_bid_and_fund. A subtle gap: an investor who was verified at place_bid time but whose KYC is later revoked must not have their bid accepted-and-funded. There is no regression asserting acceptance re-checks investor verification at fund time.

Why this matters: KYC must be enforced at the moment funds move, not just at bid placement. If acceptance trusts a stale verification, a revoked investor can still fund β€” a compliance hole. This locks the re-check at the fund boundary.

🎯 Requirements & Context

  • Add quicklendx-contracts/src/test_kyc_recheck_on_accept.rs.
  • Verify investor, place a bid, revoke investor KYC, then assert accept_bid_and_fund rejects with the KYC error from errors.rs.
  • Assert no escrow is created and no funds move on the rejected acceptance.
  • Positive control: a still-verified investor's bid accepts normally.

Context & constraints

  • Token helpers consistent with test_investor_kyc.rs. If acceptance does NOT currently re-check, document it as a finding.

πŸ› οΈ Suggested Execution

git checkout -b test/kyc-recheck-on-accept
cargo test -p quicklendx-contracts test_kyc_recheck_on_accept -- --nocapture
cargo clippy -p quicklendx-contracts --all-targets -- -D warnings
  • Edge cases: revoke between place and accept; revoke then re-verify before accept; pending (never verified) investor.

Example commit message

test(kyc): assert accept_bid_and_fund re-checks investor verification at fund time

Locks that a revoked investor cannot fund escrow via a previously-placed bid.

βœ… Acceptance Criteria & Guidelines

Requirement Target
KYC re-check at fund time asserted Required
No escrow/funds on rejection Required
Finding documented if gap exists Required
Coverage of acceptance path β‰₯ 95%
cargo clippy clean Required
Timeframe 96 hours from assignment

πŸ’¬ Community & Support

Join Discord: https://discord.gg/VpngvTjWa β€” comment to claim. πŸš€

Metadata

Metadata

Assignees

No one assigned

    Labels

    GRANTFOX OSSGrantFox OSS campaignMAYBE REWARDEDGrantFox OSS campaignOFFICIAL CAMPAIGNGrantFox OSS campaignbiddingDesign / UX backlog: biddingintermediatekycDesign / UX backlog: kycsecuritySecurity hardening and auditssmart-contractSoroban/Rust smart contract worktestingTests and coverage

    Type

    Fields

    No fields configured for Task.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions