Skip to content

Add contract-level duplicate payment detection and rejection #431

Description

@Kingsman-99

Description

Identical payments (same payer, same amount, same ledger) can be submitted twice due to network retries, resulting in double-charging. This issue adds a payment fingerprint registry that detects and rejects duplicate submissions within a configurable ledger window.

Technical Context

Compute a payment fingerprint hash = sha256(invoice_id || payer || amount || ledger_sequence) using env.crypto().sha256() in lib.rs. Store fingerprint_key(hash) -> bool with a TTL of DUPLICATE_WINDOW_LEDGERS. Before processing pay_invoice, check for an existing fingerprint entry; if present, panic with DuplicatePayment. After processing, store the fingerprint.

Acceptance Criteria

  • Payment fingerprint is computed from invoice_id, payer, amount, and current ledger sequence
  • Duplicate submission within DUPLICATE_WINDOW_LEDGERS panics with DuplicatePayment
  • Fingerprint storage uses Soroban temporary storage with correct TTL so old entries expire automatically
  • Different amounts from the same payer in the same ledger are NOT considered duplicates
  • DUPLICATE_WINDOW_LEDGERS is admin-configurable; default 5 ledgers
  • Tests: identical call twice fails, same payer different amount passes, after window expiry same call succeeds
  • All CI checks (cargo test, cargo clippy, cargo fmt) pass and the branch has no merge conflicts

Metadata

Metadata

Labels

Stellar WaveIssues in the Stellar wave programcomplexity: highComplex feature requiring deep knowledge - 200 ptsfeatureNew contract feature or operation

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions