Reject a Split dispute resolution whose components are individually within but jointly exceed balance

[mikewheeleer]

Reject a Split dispute resolution whose components are individually within but jointly exceed balance

Description

resolution_payouts in contracts/escrow/src/dispute.rs handles DisputeResolution::Split(client, freelancer) by rejecting negative components and requiring client + freelancer == available. The safe_add_amounts guard catches overflow, but the boundary where each component is a large positive value near i128::MAX such that their sum overflows — and must be rejected as PotentialOverflow rather than wrapping into a value that coincidentally equals available — is not directly tested.

This issue adds targeted tests proving the Split validation rejects overflow-prone and mismatched component pairs, and accepts only exact, conserving splits.

Requirements and context

• Repository scope: Talenttrust/Talenttrust-Contracts only.
• Test: Split with a negative component returns InvalidDisputeSplit.
• Test: Split whose components sum to less/more than available returns InvalidDisputeSplit.
• Test: Split components near i128::MAX that would overflow return PotentialOverflow, not a wrapped match.
• Test: an exact, conserving Split succeeds and updates released_amount/refunded_amount correctly.

Suggested execution

• Fork the repo and create a branch
• git checkout -b security/contracts-split-overflow-guard
• Implement changes
  • Write code in: contracts/escrow/src/dispute.rs only if the overflow ordering needs hardening.
  • Write comprehensive tests in: contracts/escrow/src/test/dispute.rs and contracts/escrow/src/test/resolution_payouts_prop.rs.
  • Add documentation: note the Split validation order under docs/escrow.
  • Include NatSpec-style doc comments (///) on the Split branch.
  • Validate security: no overflow can masquerade as a valid split.
• Test and commit

Test and commit

• Run cargo fmt --all -- --check, cargo build, and cargo test.
• Cover negative, mismatched, overflow, and exact splits.
• Include the full cargo test output in the PR description.

Example commit message

test: harden Split dispute validation against overflow and mismatch

Guidelines

• Minimum 95 percent test coverage for impacted modules.
• Clear, reviewer-focused documentation.
• Timeframe: 96 hours.

Community & contribution rewards

• 💬 Join the TalentTrust community on Discord for questions, reviews, and faster merges: https://discord.gg/WqnGpcPx
• ⭐ This is a GrantFox OSS / Official Campaign task and may be rewarded. When your PR is merged you'll be prompted to rate the project — if this issue and the maintainers helped you ship, we'd be grateful for a 5-star rating. Clear questions in Discord and tidy, well-tested PRs are the fastest path to a merge and a reward.

[binayyub4211]

@binayyub4211 has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

Hey maintainer,
Kindly assign me to work on this issue,
Thank u

ℹ️ Repo Maintainers: To accept this application, review their application or assign @binayyub4211 to this issue.

[grantfox-oss]

🦊 GrantFox — @binayyub4211 has been assigned to this issue as part of the Official Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #572)
2. Your PR will be reviewed by the Talenttrust maintainers

Good luck! Track your progress on GrantFox.

[drips-wave]

Congratulations, @binayyub4211! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on June 30, 2026.

🧑‍💻 @binayyub4211: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊