Implement fund transfer + status update in release()

[Codex723]

ISSUE #22

---

Category: Escrow Contract
Difficulty: intermediate
Labels: soroban, rust, intermediate

Files involved

• contracts/escrow/src/lib.rs

Background

After authorization passes, release() should assert the escrow is Locked and not expired, transfer state.amount of state.asset to state.recipient, then update status to Released.

This issue is part of the RemitX contributor backlog, generated from a full codebase audit of the project. RemitX is a Stellar-based remittance platform (Next.js 16, Prisma/Postgres, the Stellar SDK, and a Soroban escrow contract) currently at the "foundation build" stage: auth and the data model are real, while the Stellar integration, escrow contract internals, and several frontend pages are intentionally scaffolded with TODO(contributor) markers. See FOUNDATION.md in the repo root for the full project map and current status of every subsystem before starting.

Suggested approach

1. Review the current implementation in contracts/escrow/src/lib.rs and confirm the stub/gap described below.
2. After authorization passes, release() should assert the escrow is Locked and not expired, transfer state.amount of state.asset to state.recipient, then update status to Released.
3. Handle the edge cases and failure modes called out in the acceptance criteria below (e.g. reverts if escrow is not locked).
4. Manually verify the change against the acceptance criteria below before opening a PR.
5. Update any relevant comments/docs (e.g. remove the TODO(contributor) marker this issue resolves, if applicable).

Acceptance criteria

• Reverts if escrow is not Locked
• Reverts if past expires_at
• Recipient balance increases by the correct amount after release

Notes for contributors

• Keep the change scoped to this issue — if you notice other stubs or bugs nearby, open a separate issue rather than bundling fixes into this PR.
• Match the existing code style in the surrounding file. This codebase uses TypeScript strict mode, Zod for input validation, and the shared successResponse/errorResponse helpers in src/lib/api-response.ts for every API route.
• If this issue depends on another issue in this area being done first, check the related issues below before starting — some subsystems (e.g. the escrow contract's release() authorization) need a design decision made before implementation can proceed.
• Please reference this issue number in your PR description, and check off acceptance criteria as you satisfy them.

Related issues in this area

• Write a design doc / RFC resolving the release() authorization model #18
• Implement deposit() token transfer logic #19
• Generate a real escrow_id hash in deposit() #20
• Implement chosen release() authorization mechanism #21
• Implement time-check + transfer logic in refund() #23