[bug] escrow-vault: approve_release only blocks Released state — approvals accepted on Refunded and Disputed escrows

[gboigwe]

Summary

approve_release checks if escrow.state == EscrowState::Released { panic!("already released") }. Only the Released terminal state blocks new approvals. A Refunded escrow (funds already returned to depositor) or a Disputed escrow (held for fraud review) can still receive new approvals from required approvers, incrementing ApprovalCount on a closed or locked escrow. These approvals are meaningless but waste storage rent.

Location

contracts/escrow-vault/src/lib.rs, approve_release

if escrow.state == EscrowState::Released {
    panic!("already released"); // ❌ Refunded and Disputed not blocked
}

Fix

Block all terminal states:

match escrow.state {
    EscrowState::Released | EscrowState::Refunded | EscrowState::Disputed => {
        panic!("escrow is not in an approvable state");
    }
    _ => {}
}