[Democodes-flash]

Overview

This PR makes the analytics/report entrypoints reachable and correct: report IDs are now unique per generation (counter-based), report generation requires subject auth, and dispute_resolution_time is computed from the real dispute module instead of the stubbed helpers in defaults.rs.

Related Issue

Changes

🔢 Unique report IDs

• [MODIFY] quicklendx-contracts/src/analytics.rs
  • AnalyticsStorage::generate_report_id now derives IDs from the previously-unused rpt_cnt counter, the subject XDR, and the timestamp, and increments rpt_cnt on each call. Two reports generated in the same ledger for different subjects no longer collide.

Old derivation:

// hashed only (timestamp, sequence) — collides within a ledger
sha256(timestamp ‖ sequence)

New derivation:

// counter is monotonic and incremented per report
let counter = get_rpt_cnt(env);
set_rpt_cnt(env, counter + 1);
sha256(counter ‖ subject_xdr ‖ timestamp)

🔐 Auth on report generation

• [MODIFY] quicklendx-contracts/src/analytics.rs
  • generate_business_report(business, period) requires business.require_auth().
  • generate_investor_report(investor, period) requires investor.require_auth().
  • Added entrypoints: get_business_report(report_id), get_investor_report(report_id), get_platform_metrics(), get_performance_metrics(), export_analytics_snapshot().

🧹 Remove dispute stubs, rewire to real implementation

• [MODIFY] quicklendx-contracts/src/defaults.rs
  • Deleted the stub get_invoices_with_disputes (returned Vec::new) and get_dispute_details (returned Ok(None)).
• [MODIFY] quicklendx-contracts/src/analytics.rs
  • calculate_performance_metrics now reads disputes via crate::dispute::get_invoices_with_disputes and crate::dispute::get_dispute_details, so dispute_resolution_time reflects resolved disputes.

🔌 Wiring

• [MODIFY] quicklendx-contracts/src/lib.rs
  • Declared/fixed the touched modules and exposed initialize plus the new analytics entrypoints.

Verification Results

cargo test -p quicklendx-contracts
✅ same_ledger_reports_have_distinct_ids
✅ report_generation_requires_subject_auth
✅ dispute_resolution_time_is_measured
✅ dispute_resolution_time_averages

Acceptance Criteria	Status
Same-ledger reports for A and B have distinct IDs; get_business_report(id_a).business_address == A	✅ same_ledger_reports_have_distinct_ids
Generation without mock_all_auths, signed by B, fails auth	✅ report_generation_requires_subject_auth
Single dispute resolved after 3_600 s yields dispute_resolution_time == 3_600	✅ dispute_resolution_time_is_measured
Two disputes resolved after 1_000 s and 3_000 s yield dispute_resolution_time == 2_000	✅ dispute_resolution_time_averages

Closes #2938

[drips-wave]

@Democodes-flash Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[Baskarayelu]

Hi @Democodes-flash — heads-up before we can merge this.

Our malware scan found that an earlier commit on this branch carries a PolinRider malware payload (obfuscated code hidden after a long run of spaces in backend/api.js and quicklendx-frontend/postcss.config.mjs, plus a node api.js launcher in package.json). The later "remove injected build hook" commit removes it from the final diff, but the payload is still in this branch's commit history, and the original commit means the machine it was made on was most likely infected.

Please:

1. Check your machine for a PolinRider infection and rotate your GitHub/npm tokens from a clean device.
2. Recreate your branch from the current main and re-apply only your own changes as fresh commits (also drop the unrelated package.json description, postcss.config.mjs blank-line and branch_structure.json leftovers), then force-push to this branch.

Once the branch history is clean and the PolinRider guard passes, we'll merge it. Thanks!

[Baskarayelu]

Hi @Democodes-flash — thanks for removing the payload. The final diff is now clean, but this branch's commit history still contains the PolinRider malware (the earlier commit with obfuscated code hidden in config files and a node api.js launcher), so we still can't merge it.

How to fix (without opening the old branch in VS Code / Cursor):

git fetch upstream main
git checkout -B <your-branch> upstream/main          # start fresh from clean main
git checkout <your-last-commit> -- <only your own source/test files>
git commit -m "<your change>"
git push --force origin <your-branch>

Please do not bring back .vscode/, public/fonts/, api.js, branch_structure.json or any package.json / postcss.config.mjs / eslint.config.js edits you did not intend. If you opened this repo in an editor while those files were present, please check your machine for PolinRider and rotate your GitHub/npm tokens from a clean device.

As soon as the branch history is clean and the PolinRider guard passes, we will merge it. Thank you!

[Democodes-flash]

@Baskarayelu — this PR is ready for another review. I resolved the merge conflicts with the main branch (pushed 646631b).
Files changed: quicklendx-contracts/src/escrow.rs

[drips-wave]

Warning

Possible malicious code: please review before merging.

An automated security scan flagged files in this pull request that appear to contain malicious code. Code like this can run automatically when a project is opened in an editor or its dependencies are installed, so it could compromise the machine of anyone who checks out this branch.

Automated scans can be wrong, so this may be a false positive. Maintainers: please review the flagged files carefully before merging, on GitHub in your browser rather than by checking out the branch. The malicious part is often hidden far off to the right of an ordinary-looking line, so scroll sideways through each file.

@Democodes-flash: this pull request adds or changes these files, possibly without your knowledge. Malware like this spreads by adding itself to repositories on machines it has infected, so your machine might be compromised. Please undo these changes in this pull request, and don't open or run other projects on that machine until you've checked it.

Flagged files at commit 61f31b6:

• .gitignore
• backend/init
• backend/package.json
• quicklendx-frontend/init
• quicklendx-frontend/package.json
• quicklendx-frontend/postcss.config.mjs

Only merge once you're confident these files are safe.

ℹ️ Posted automatically by Drips Wave. Questions? Contact support@drips.network.