chore(contracts): enforce developer must be provided when to_pool=fal……se (tests + docs)

SECURITY.md

@@ -128,6 +128,8 @@ The vault performs USDC transfers to configurable counterpart addresses on every
 - [ ] Minimum deposit requirements enforced
 - [ ] Maximum deduction limits enforced
 - [x] Revenue pool transfers validated
+- [x] Settlement developer address required when routing to specific developer.
+- [x] Settlement developer address must be None when routing to global pool.
 - [ ] Batch operations respect individual limits
 
 ### Revenue Pool Security Assumptions

contracts/settlement/src/lib.rs

@@ -121,6 +121,9 @@ impl CalloraSettlement {
         }
         let inst = env.storage().instance();
         if to_pool {
+            if developer.is_some() {
+                panic!("developer address must be None when to_pool=true");
+            }
             let mut global_pool = Self::get_global_pool(env.clone());
             global_pool.total_balance = global_pool
                 .total_balance

contracts/settlement/src/test.rs

@@ -590,6 +590,21 @@ mod settlement_tests {
         client.receive_payment(&vault, &100i128, &false, &None);
     }
 
+    #[test]
+    #[should_panic(expected = "developer address must be None when to_pool=true")]
+    fn test_receive_payment_pool_true_with_developer() {
+        let env = Env::default();
+        env.mock_all_auths();
+        let admin = Address::generate(&env);
+        let vault = Address::generate(&env);
+        let developer = Address::generate(&env);
+        let addr = env.register(CalloraSettlement, ());
+        let client = CalloraSettlementClient::new(&env, &addr);
+        client.init(&admin, &vault);
+
+        client.receive_payment(&vault, &100i128, &true, &Some(developer));
+    }
+
     #[test]
     fn test_receive_payment_authorization_matrix() {
         enum CallerRole {