Issues

perf(bid,investment): placing and accepting bids scans every active investment in the protocol and a global all_bids vector — O(protocol size) per call

QuickLendX/quicklendx-protocol#2970 · opened

on Oct 18, 2026

5

fix(pause): pauses silently expire after 7 days with no event, leave a stale reason behind, and is_entrypoint_paused checks the wrong list

QuickLendX/quicklendx-protocol#2967 · opened

on Oct 18, 2026

2

fix(kyc): verify_investor re-approves Rejected/revoked investors without resubmission, and resubmitted investors stay in the rejected index

QuickLendX/quicklendx-protocol#2966 · opened

on Oct 18, 2026

3

fix(governance): the open-proposal counter is never incremented, so require_no_open_governance_proposal never blocks anything

QuickLendX/quicklendx-protocol#2964 · opened

on Oct 18, 2026

4

fix(defaults): an invoice can be defaulted while its dispute is open, even though settlement is blocked by the same dispute

QuickLendX/quicklendx-protocol#2960 · opened

on Oct 18, 2026

2

fix(settlement): settlement reverts whenever the platform fee is below MIN_TRANSFER (1 token), so low-margin invoices can never be paid

QuickLendX/quicklendx-protocol#2958 · opened

on Oct 18, 2026

4

fix(investment): status queries only see Active investments, portfolio summary freezes at the oldest 50, and by_* helpers read keys nothing writes

QuickLendX/quicklendx-protocol#2957 · opened

on Oct 18, 2026

3

fix(bid): cleanup_expired_bids_paged duplicates bid IDs in the invoice index whenever it runs on a partial window

QuickLendX/quicklendx-protocol#2953 · opened

on Oct 18, 2026

2

fix(invoice): lifecycle setters accept any source state, metadata can be rewritten after funding, and cancel() never authenticates

QuickLendX/quicklendx-protocol#2951 · opened

on Oct 18, 2026

2

fix(storage): InvoiceStorage::is_frozen traps on every frozen invoice, and the 30-day lock limit can never fire

QuickLendX/quicklendx-protocol#2950 · opened

on Oct 18, 2026

2

fix(init): set_protocol_config / set_fee_config / set_treasury write keys the enforcement paths never read

QuickLendX/quicklendx-protocol#2949 · opened

on Oct 18, 2026

2

security(currency): removing the last whitelisted token silently switches the protocol to accept-any-token

QuickLendX/quicklendx-protocol#2948 · opened

on Oct 18, 2026

3

security(protocol_limits): per-address rate-limit records live in instance storage — about 485 fresh addresses fill the instance entry and block admin writes

QuickLendX/quicklendx-protocol#2946 · opened

on Oct 18, 2026

2

security(kyc): delete_business/restore_business have no authorization, a deleted business can still be KYC-verified, and restore duplicates list entries

QuickLendX/quicklendx-protocol#2943 · opened

on Oct 18, 2026

2

security(dispute): dispute resolution requires the resolver to be admin AND arbiter, so a dedicated arbiter can never resolve and the admin can self-register to adjudicate alone

QuickLendX/quicklendx-protocol#2942 · opened

on Oct 18, 2026

2

feat(analytics): expose analytics/report entrypoints with unique report IDs and real dispute-resolution metrics

QuickLendX/quicklendx-protocol#2938 · opened

on Oct 18, 2026

2

feat(vesting): expose vesting entrypoints and fix stuck sub-minimum tails, panicking release and the O(all schedules) summary

QuickLendX/quicklendx-protocol#2936 · opened

on Oct 18, 2026

2

feat(contract): expose currency whitelist and protocol-limits administration with paged reads

QuickLendX/quicklendx-protocol#2935 · opened

on Oct 18, 2026

2

feat(contract): expose pause, maintenance mode and timelocked emergency withdrawal entrypoints

QuickLendX/quicklendx-protocol#2934 · opened

on Oct 18, 2026

1

feat(defaults): expose invoice default handling and stop letting callers choose the grace period (including 0)

QuickLendX/quicklendx-protocol#2932 · opened

on Oct 18, 2026

3

feat(contract): implement place_bid / withdraw_bid / cancel_bid entrypoints on top of validate_bid and BidStorage

QuickLendX/quicklendx-protocol#2928 · opened

on Oct 18, 2026

2

feat(contract): expose business and investor KYC entrypoints from verification.rs and kyc_policy.rs

QuickLendX/quicklendx-protocol#2927 · opened

on Oct 18, 2026

2

fix(contracts): module tree does not compile once declared in lib.rs (12 errors across fees, settlement, audit, escrow, bench, scratch_events)

QuickLendX/quicklendx-protocol#2924 · opened

on Oct 18, 2026

2

security(ingest): POST /api/v1/events accepts forged contract events from any caller, poisoning the replay archive and squatting event ids

QuickLendX/quicklendx-protocol#2904 · opened

on Oct 18, 2026

3

security(admin): `X-API-Key: constructor` bypasses admin authentication, and SKIP_API_KEY_AUTH is honoured in production

QuickLendX/quicklendx-protocol#2903 · opened

on Oct 18, 2026

3

Navigation Menu

Repository navigation

Issues

perf(bid,investment): placing and accepting bids scans every active investment in the protocol and a global all_bids vector — O(protocol size) per call

fix(pause): pauses silently expire after 7 days with no event, leave a stale reason behind, and is_entrypoint_paused checks the wrong list

fix(kyc): verify_investor re-approves Rejected/revoked investors without resubmission, and resubmitted investors stay in the rejected index

fix(governance): the open-proposal counter is never incremented, so require_no_open_governance_proposal never blocks anything

fix(defaults): an invoice can be defaulted while its dispute is open, even though settlement is blocked by the same dispute

fix(settlement): settlement reverts whenever the platform fee is below MIN_TRANSFER (1 token), so low-margin invoices can never be paid

fix(investment): status queries only see Active investments, portfolio summary freezes at the oldest 50, and by_* helpers read keys nothing writes

fix(bid): cleanup_expired_bids_paged duplicates bid IDs in the invoice index whenever it runs on a partial window

fix(invoice): lifecycle setters accept any source state, metadata can be rewritten after funding, and cancel() never authenticates

fix(storage): InvoiceStorage::is_frozen traps on every frozen invoice, and the 30-day lock limit can never fire

fix(init): set_protocol_config / set_fee_config / set_treasury write keys the enforcement paths never read

security(currency): removing the last whitelisted token silently switches the protocol to accept-any-token

security(protocol_limits): per-address rate-limit records live in instance storage — about 485 fresh addresses fill the instance entry and block admin writes

security(kyc): delete_business/restore_business have no authorization, a deleted business can still be KYC-verified, and restore duplicates list entries

security(dispute): dispute resolution requires the resolver to be admin AND arbiter, so a dedicated arbiter can never resolve and the admin can self-register to adjudicate alone

feat(analytics): expose analytics/report entrypoints with unique report IDs and real dispute-resolution metrics

feat(vesting): expose vesting entrypoints and fix stuck sub-minimum tails, panicking release and the O(all schedules) summary

feat(contract): expose currency whitelist and protocol-limits administration with paged reads

feat(contract): expose pause, maintenance mode and timelocked emergency withdrawal entrypoints

feat(defaults): expose invoice default handling and stop letting callers choose the grace period (including 0)

feat(contract): implement place_bid / withdraw_bid / cancel_bid entrypoints on top of validate_bid and BidStorage

feat(contract): expose business and investor KYC entrypoints from verification.rs and kyc_policy.rs

fix(contracts): module tree does not compile once declared in lib.rs (12 errors across fees, settlement, audit, escrow, bench, scratch_events)

security(ingest): POST /api/v1/events accepts forged contract events from any caller, poisoning the replay archive and squatting event ids

security(admin): `X-API-Key: constructor` bypasses admin authentication, and SKIP_API_KEY_AUTH is honoured in production