Summary
Before deploying to mainnet with real value at stake, the contracts need to be prepared for a formal external security audit. This means: complete NatSpec/doc comments, documented invariants, and a threat model doc that auditors can use to scope their work efficiently.
Problem
- Inline doc comments are present but inconsistent — some functions have no docs
- No formal statement of contract invariants (what must always be true)
- No threat model documenting trusted roles, attack surfaces, and known limitations
- Without these, an external audit will be slower, more expensive, and may miss context-specific issues
Acceptance Criteria
NatSpec / Rust doc comments
Invariants document
Threat model
References
contracts/rewards/src/lib.rscontracts/campaign/src/lib.rsdocs/
Summary
Before deploying to mainnet with real value at stake, the contracts need to be prepared for a formal external security audit. This means: complete NatSpec/doc comments, documented invariants, and a threat model doc that auditors can use to scope their work efficiently.
Problem
Acceptance Criteria
NatSpec / Rust doc comments
contracts/rewards/src/lib.rsandcontracts/campaign/src/lib.rshave complete///doc comments with:@param,@returns,@emits,@errorssectionsErrorenums are documented with when they're returnedInvariants document
contracts/INVARIANTS.mddocumenting:sum(all balances) + total_claimed == sum(all credits ever)balance(user) >= 0always (enforced by u64 semantics)participant_count <= max_capwhen max_cap > 0participant_countonly increments, never decrementsThreat model
docs/THREAT_MODEL.mdcovering:References
contracts/rewards/src/lib.rscontracts/campaign/src/lib.rsdocs/