prepare security audit checklist and formal verification tests

[Divineifed1]

Description:
Before mainnet deployment, all contracts must pass a structured security review. This issue covers creating the audit checklist, running static analysis, and preparing formal verification specs for critical invariants.

Acceptance criteria:

• Audit checklist covers: reentrancy, overflow/underflow, access control, front-running, oracle manipulation
• cargo audit passes with no high/critical vulnerabilities
• cargo clippy runs with -D warnings in CI
• Formal verification specs written for betting (payout correctness) and player-nft (ownership invariant)
• All unsafe blocks documented and justified

[mijinummi]

Hello maintainers I'm a full stack developer experience in building scalable systems I can handle this perfectly

[Phantomcall]

I'd like to work on this issue.

I have experience hardening Rust/Soroban projects before release and would be happy to own the security review preparation. I'll create a structured audit checklist covering reentrancy, integer overflow/underflow, access control, front-running vectors, oracle manipulation, storage invariants, authorization flows, and other contract-specific risks, ensuring each item maps to the relevant contracts and code paths.

I'll also integrate cargo audit and cargo clippy -D warnings into the project's verification workflow, resolve or document any findings, and prepare formal verification specifications for the critical invariants—specifically payout correctness for the betting contract and ownership preservation for the player NFT contract. In addition, I'll review the codebase for any unsafe blocks, documenting the justification and safety guarantees for each occurrence (or confirming that none exist), and produce reviewer-friendly documentation so future security audits have a clear baseline. The goal is to leave the repository with reproducible security checks, well-defined invariants, and documentation that supports both maintainers and external auditors.

[aliybabsi]

Hello Maintainer, I'll like to work on this
Please assign me

[ComputerOracle]

hello maintainer ill like to work on this issue

[grantfox-oss]

🦊 GrantFox — @mijinummi has been assigned to this issue as part of the Official Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #16)
2. Your PR will be reviewed by the Exquisitech maintainers

Good luck! Track your progress on GrantFox.