Feature/merchant registry kyc whitelisting

[Timrossid]

Implements a comprehensive Merchant Registry and KYC Whitelisting system that protects the SubStream protocol from phishing scams and malicious actors. This feature ensures only verified entities can create recurring subscription plans while giving the DAO community decentralized control to instantly blacklist bad actors.

🔧 Key Features
🛡️ Security & Verification
SEP-12 KYC Integration - Merchants must provide verified KYC credentials from authorized issuers
DAO Multi-Sig Approval - Alternative approval path through decentralized governance (3-vote threshold)
RBAC Whitelist System - Role-based access control with dual verification methods
Instant Blacklisting - DAO can immediately revoke merchant access while protecting user funds
📊 Transparent Governance
Public Registry Events - Complete audit trail of all merchant actions
DAO Proposal System - 7-day voting periods with automatic execution
Vote Tracking - Immutable record of all governance decisions
Merchant Status History - Comprehensive verification timeline
🔒 Fund Protection
Subscription Guards - Prevents subscriptions to unverified/blacklisted merchants
Collection Blocking - Blacklisted merchants cannot pull funds from existing subscriptions
User Fund Safety - Blacklisting only affects merchant access, not user deposits
Plan Registration Control - Only verified merchants can create pricing plans
🏗️ Technical Implementation
New Data Structures
rust
pub struct MerchantStatus { ... }
pub struct KYCCredential { ... }
pub struct DAOProposal { ... }
pub struct DAOVote { ... }
pub enum VerificationMethod { SEP12KYC, DAOApproval }
Core Functions
register_merchant_with_kyc() - SEP-12 KYC registration
create_merchant_proposal() - DAO governance proposals
vote_on_merchant_proposal() - Multi-sig voting
blacklist_merchant() - Instant merchant blacklisting
is_merchant_verified() - Verification status checks
Security Integration
Updated subscribe() and subscribe_gift() with merchant verification
Enhanced distribute_and_collect() to block blacklisted merchants
Modified register_plan() for verified merchants only
🧪 Comprehensive Testing
Created 10 comprehensive test scenarios covering:

✅ Valid KYC registration and verification
✅ Unauthorized issuer rejection
✅ DAO proposal workflow and execution
✅ Merchant blacklisting functionality
✅ Subscription protection mechanisms
✅ Fund protection for blacklisted merchants
✅ Duplicate registration prevention
✅ Multi-sig voting validation
✅ Event emission verification
📊 Acceptance Criteria Met
✅ Acceptance 1: Only verified, DAO-approved entities can create recurring subscription plans
Implementation: Merchant verification checks in all subscription and plan registration functions
Methods: Both SEP-12 KYC and DAO approval paths supported
✅ Acceptance 2: The community holds the decentralized power to sever malicious merchants instantly
Implementation: DAO blacklisting with immediate fund collection blocking
Protection: User funds remain safe while merchant access is instantly revoked
🔐 Security Benefits
Phishing Prevention
No Anonymous Merchants - All merchants must be KYC verified or DAO approved
Identity Verification - SEP-12 compliant credential validation
Reputation System - Merchant history and verification tracking
Rapid Response
Instant Blacklisting - DAO can immediately revoke malicious merchant access
Fund Protection - User deposits are safe even after blacklisting
Collection Blocking - Prevents further fund drainage from blacklisted merchants
Transparent Governance
Public Audit Trail - All actions emit events for complete transparency
Decentralized Control - Community-driven decision making
Immutable Records - Blockchain-stored governance history
📈 Integration Impact
Backward Compatibility
✅ Existing subscriptions continue to work
✅ No breaking changes to current API
✅ Gradual migration path for existing merchants
Performance Considerations
⚡ Minimal gas overhead for verification checks
⚡ Efficient storage patterns for merchant data
⚡ Optimized event emission for transparency
🚀 Deployment Ready
✅ Branch: feature/merchant-registry-kyc-whitelisting
✅ Tests: 10 comprehensive security scenarios
✅ Documentation: Complete code coverage with comments
✅ Events: Full audit trail implementation
🔗 Related Issues
Resolves: #110 Merchant Registry and KYC Whitelisting
Enhances: Existing subscription security model
Complements: SLA Circuit Breaker and Enhanced Subscription features
🎯 Impact
This implementation transforms SubStream into a trusted, regulated marketplace while maintaining decentralization. It protects users from phishing scams, ensures merchant accountability, and gives the community tools to maintain ecosystem safety.

[drips-wave]

@Timrossid Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits