Commission an external smart-contract security audit before mainnet

[joelpeace48-cell]

Epic: Mainnet Readiness & Financial Safety

Summary

Engage a reputable Soroban/Rust auditor to review both contracts and publish the report.

Background & Problem

The contracts hold user points redeemable for real assets. 182 unit tests + fuzzing + Kani are strong but are not a substitute for an independent audit before custody of value.

Impact / Why it matters

Audit is table-stakes for mainnet credibility and for most grant/exchange integrations.

Proposed Approach

• Prepare an audit-ready snapshot (frozen commit, threat model, docs).
• Solicit quotes from Soroban-experienced firms/independent auditors.
• Track findings as issues; re-audit deltas.

Acceptance Criteria

• Audit report published under docs/audits/.
• All critical/high findings resolved or accepted with rationale.

---

Filed as part of the mainnet-readiness & world-class roadmap. Scope is intentionally small enough for one focused PR; comment to claim.

[Binali223]

@Binali223 has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hi! I've gone through the issue and would love to work on it. Thanks

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Binali223 to this issue.

[shogun444]

@shogun444 has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hi, This issue is something i can resolve, I'd love to work on it Kindly Assign me, Thank you.

Portfolio : https://portfolio-amber-one-v8ggyhsjyr.vercel.app/

ℹ️ Repo Maintainers: To accept this application, review their application or assign @shogun444 to this issue.

[miraclesonly]

@miraclesonly has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hi, I understand the task and I’m ready to get started.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @miraclesonly to this issue.

[drips-wave]

Congratulations, @miraclesonly! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on August 31, 2026.

🧑‍💻 @miraclesonly: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊

[miraclesonly]

Flagging scope on this one: commissioning and publishing an independent smart-contract audit isn't something that can be closed by a PR — it requires actually engaging and paying an external Soroban/Rust auditing firm, which is a business decision/procurement action, not a code change. I'm not marking this closed as part of PR #1134 (which handles #834/#838/#835 instead).

What I can help prep, if useful: an audit-ready snapshot (frozen commit + a short threat-model doc summarizing the points-redemption/reserve/timelock/multisig surfaces) so whoever runs procurement has something concrete to hand a firm for a quote. Let me know if you'd like that as a separate PR.