chore(contracts): validate payments vector length to prevent resource exhaustion (#252)

[felixkamau]

Closes #252

---

Description

Resolves (#252)

This PR strengthens the revenue-pool contract by enforcing a strict upper bound on the payments vector in batch_distribute, mitigating potential resource exhaustion attacks. It also resolves several pre-existing compilation issues and failing fuzz tests across the workspace.

---

Changes

• Batch Size Enforcement
  Introduced MAX_BATCH_SIZE = 50 (aligned with the vault design) to cap iterations in batch_distribute.

• Pre-Execution Validation
  Added guards for:

  • Empty input arrays
  • Oversized batches exceeding the defined limit
    These checks run before any state access or mutation.

• Documentation Updates

  • Extended SECURITY.md to document the unbounded batch attack vector
  • Updated INVARIANTS.md with the new length constraint precondition

• Workspace Stability Fixes

  • Resolved 6 failing tests in callora-vault, including:

    • Adding a missing pause circuit breaker in deduct
    • Fixing incorrect fuzz test assertions

  • Fixed unused variable warnings in callora-settlement

  • Ensured cargo test --workspace passes cleanly

---

Security Considerations

• Enforcing MAX_BATCH_SIZE prevents abuse scenarios where a compromised admin could submit excessively large batches to exhaust Soroban execution limits.
• Validation occurs before iteration, storage access, or token transfers, ensuring early failure with minimal resource consumption.
• The 50-item cap maintains symmetry with the vault’s existing batch_deduct constraint, preserving system consistency.

---

Testing

• Added 6 edge-case tests in contracts/revenue_pool/src/test.rs, covering:

  • Empty inputs
  • Oversized batches
  • Negative values
  • Unauthorized callers
  • Self-distribution scenarios

• Full workspace test suite now passes:

Summarized Test Output

$ cargo clippy --all-targets --all-features -- -D warnings
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 3.66s

$ cargo test --workspace
...
test result: ok. 45 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.71s
     Running unittests src\lib.rs (target\debug\deps\callora_settlement-87497a947974c963.exe)
test result: ok. 52 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.21s
     Running unittests src\lib.rs (target\debug\deps\callora_vault-c04abfecf05f45fa.exe)
test result: ok. 179 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.23s

# Total: 276 / 276 tests passed

[drips-wave]

@felixkamau Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits