Generate a real escrow_id hash in deposit()

[Codex723]

ISSUE #20

---

Category: Escrow Contract
Difficulty: intermediate
Labels: soroban, rust, intermediate

Files involved

• contracts/escrow/src/lib.rs

Background

deposit() currently returns a hardcoded all-zero BytesN<32>. Generate a deterministic hash from (sender, recipient, amount, expires_at) plus a nonce/counter to avoid collisions.

This issue is part of the RemitX contributor backlog, generated from a full codebase audit of the project. RemitX is a Stellar-based remittance platform (Next.js 16, Prisma/Postgres, the Stellar SDK, and a Soroban escrow contract) currently at the "foundation build" stage: auth and the data model are real, while the Stellar integration, escrow contract internals, and several frontend pages are intentionally scaffolded with TODO(contributor) markers. See FOUNDATION.md in the repo root for the full project map and current status of every subsystem before starting.

Suggested approach

1. Review the current implementation in contracts/escrow/src/lib.rs and confirm the stub/gap described below.
2. deposit() currently returns a hardcoded all-zero BytesN<32>. Generate a deterministic hash from (sender, recipient, amount, expires_at) plus a nonce/counter to avoid collisions.
3. Add or update tests so the behavior is verifiable and won't silently regress.
4. Update any relevant comments/docs (e.g. remove the TODO(contributor) marker this issue resolves, if applicable).

Acceptance criteria

• escrow_id is unique per deposit call
• Collision-resistant (uses env crypto hash, not raw concatenation)
• Unit test asserts two different deposits get different IDs

Notes for contributors

• Keep the change scoped to this issue — if you notice other stubs or bugs nearby, open a separate issue rather than bundling fixes into this PR.
• Match the existing code style in the surrounding file. This codebase uses TypeScript strict mode, Zod for input validation, and the shared successResponse/errorResponse helpers in src/lib/api-response.ts for every API route.
• If this issue depends on another issue in this area being done first, check the related issues below before starting — some subsystems (e.g. the escrow contract's release() authorization) need a design decision made before implementation can proceed.
• Please reference this issue number in your PR description, and check off acceptance criteria as you satisfy them.

Related issues in this area

• Write a design doc / RFC resolving the release() authorization model #18
• Implement deposit() token transfer logic #19
• Implement chosen release() authorization mechanism #21
• Implement fund transfer + status update in release() #22
• Implement time-check + transfer logic in refund() #23