[Draft] Add Demo app for the Stellar Debit Card Contracts by marwen-abid · Pull Request #4 · stellar/debit-card-reference

marwen-abid · 2026-04-28T22:59:34Z

No description provided.

- Split `set_pauser` into `set_pauser_by_owner` / `set_pauser_by_pauser` - Require `new_owner` co-signature on `set_owner` - Extract `require_factory_auth` helper in issuer - Add event assertion tests for `upgrade` and `upgrade_issuer`

socket-security · 2026-04-28T23:00:15Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/husky@9.1.7
	npm/vite@7.1.11
	npm/typescript-eslint@8.46.2
	npm/@types/react-dom@19.2.2
	npm/buffer@6.0.3
	npm/@types/react@19.2.2
	npm/@stellar/design-system@3.2.7
	npm/@types/node@24.9.1
	npm/react@19.2.3
	npm/globals@16.4.0
	npm/@tanstack/react-query@5.90.5
	npm/@eslint/js@9.38.0
	npm/eslint-plugin-react-refresh@0.4.24
	npm/typescript@5.9.3
	npm/@vitejs/plugin-react-swc@4.1.0
	npm/react-dom@19.2.3
	npm/sass@1.93.2
	npm/@stellar/stellar-sdk@14.3.0
	npm/eslint-plugin-react-hooks@5.2.0
	npm/eslint@9.38.0
	npm/lint-staged@16.2.5
	npm/prettier@3.6.2

View full report

socket-security · 2026-04-28T23:00:17Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: npm `@noble/hashes` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: example/pnpm-lock.yaml → `npm/@stellar/stellar-sdk@14.3.0` → `npm/@noble/hashes@1.8.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@noble/hashes@1.8.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `@noble/hashes` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: example/pnpm-lock.yaml → `npm/@stellar/stellar-sdk@14.3.0` → `npm/@noble/hashes@1.8.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@noble/hashes@1.8.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		High CVE: Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig CVE: GHSA-43fc-jf86-j433 Axios is Vulnerable to Denial of Service via proto Key in mergeConfig (HIGH) Affected versions: >= 1.0.0 < 1.13.5; < 0.30.3 Patched version: 1.13.5 From: example/pnpm-lock.yaml → `npm/@stellar/stellar-sdk@14.3.0` → `npm/axios@1.12.2` ℹ Read more on: This package \| This alert \| What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/axios@1.12.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		High CVE: npm `flatted` vulnerable to unbounded recursion DoS in parse() revive phase CVE: GHSA-25h7-pfq9-p65f flatted vulnerable to unbounded recursion DoS in parse() revive phase (HIGH) Affected versions: < 3.4.0 Patched version: 3.4.0 From: example/pnpm-lock.yaml → `npm/eslint@9.38.0` → `npm/flatted@3.3.3` ℹ Read more on: This package \| This alert \| What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/flatted@3.3.3`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		High CVE: Prototype Pollution via parse() in NodeJS npm `flatted` CVE: GHSA-rf6f-7fwh-wjgh Prototype Pollution via parse() in NodeJS flatted (HIGH) Affected versions: < 3.4.2 Patched version: 3.4.2 From: example/pnpm-lock.yaml → `npm/eslint@9.38.0` → `npm/flatted@3.3.3` ℹ Read more on: This package \| This alert \| What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/flatted@3.3.3`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		High CVE: npm `minimatch` ReDoS: nested () extglobs generate catastrophically backtracking regular expressions CVE:* GHSA-23c5-xmqv-rm74 minimatch ReDoS: nested () extglobs generate catastrophically backtracking regular expressions (HIGH) Affected versions:* >= 10.0.0 < 10.2.3; >= 9.0.0 < 9.0.7; >= 8.0.0 < 8.0.6; >= 7.0.0 < 7.4.8; >= 6.0.0 < 6.2.2; >= 5.0.0 < 5.1.8; >= 4.0.0 < 4.2.5; < 3.1.4 Patched version: 3.1.4 From: example/pnpm-lock.yaml → `npm/eslint@9.38.0` → `npm/minimatch@3.1.2` ℹ Read more on: This package \| This alert \| What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/minimatch@3.1.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		High CVE: npm `minimatch` has a ReDoS via repeated wildcards with non-matching literal in pattern CVE: GHSA-3ppc-4f35-3m26 minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern (HIGH) Affected versions: >= 10.0.0 < 10.2.1; >= 9.0.0 < 9.0.6; >= 8.0.0 < 8.0.5; >= 7.0.0 < 7.4.7; >= 6.0.0 < 6.2.1; >= 5.0.0 < 5.1.7; >= 4.0.0 < 4.2.4; < 3.1.3 Patched version: 3.1.3 From: example/pnpm-lock.yaml → `npm/eslint@9.38.0` → `npm/minimatch@3.1.2` ℹ Read more on: This package \| This alert \| What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/minimatch@3.1.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		High CVE: npm `minimatch` has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments CVE: GHSA-7r86-cg39-jmmj minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments (HIGH) Affected versions: >= 10.0.0 < 10.2.3; >= 9.0.0 < 9.0.7; >= 8.0.0 < 8.0.6; >= 7.0.0 < 7.4.8; >= 6.0.0 < 6.2.2; >= 5.0.0 < 5.1.8; >= 4.0.0 < 4.2.5; < 3.1.3 Patched version: 3.1.3 From: example/pnpm-lock.yaml → `npm/eslint@9.38.0` → `npm/minimatch@3.1.2` ℹ Read more on: This package \| This alert \| What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/minimatch@3.1.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		High CVE: Picomatch has a ReDoS vulnerability via extglob quantifiers CVE: GHSA-c2c7-rcm5-vvqj Picomatch has a ReDoS vulnerability via extglob quantifiers (HIGH) Affected versions: >= 4.0.0 < 4.0.4; >= 3.0.0 < 3.0.2; < 2.3.2 Patched version: 2.3.2 From: example/pnpm-lock.yaml → `npm/sass@1.93.2` → `npm/lint-staged@16.2.5` → `npm/typescript-eslint@8.46.2` → `npm/picomatch@2.3.1` ℹ Read more on: This package \| This alert \| What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/picomatch@2.3.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		High CVE: Picomatch has a ReDoS vulnerability via extglob quantifiers CVE: GHSA-c2c7-rcm5-vvqj Picomatch has a ReDoS vulnerability via extglob quantifiers (HIGH) Affected versions: >= 4.0.0 < 4.0.4; >= 3.0.0 < 3.0.2; < 2.3.2 Patched version: 4.0.4 From: example/pnpm-lock.yaml → `npm/vite@7.1.11` → `npm/picomatch@4.0.3` ℹ Read more on: This package \| This alert \| What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/picomatch@4.0.3`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		High CVE: Rollup 4 has Arbitrary File Write via Path Traversal CVE: GHSA-mw96-cpmx-2vgc Rollup 4 has Arbitrary File Write via Path Traversal (HIGH) Affected versions: < 2.80.0; >= 3.0.0 < 3.30.0; >= 4.0.0 < 4.59.0 Patched version: 4.59.0 From: example/pnpm-lock.yaml → `npm/vite@7.1.11` → `npm/rollup@4.52.5` ℹ Read more on: This package \| This alert \| What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/rollup@4.52.5`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `string-width` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: example/pnpm-lock.yaml → `npm/lint-staged@16.2.5` → `npm/string-width@8.1.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/string-width@8.1.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm `typescript` under MIT-Khronos-old License: MIT-Khronos-old - The applicable license policy does not permit this license (5) (package/ThirdPartyNoticeText.txt) License: LicenseRef-W3C-Community-Final-Specification-Agreement - The applicable license policy does not permit this license (5) (package/ThirdPartyNoticeText.txt) From: example/package.json → `npm/typescript@5.9.3` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/typescript@5.9.3`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		High CVE: npm `vite`: `server.fs.deny` bypass on Windows alternate paths CVE: GHSA-fx2h-pf6j-xcff vite: `server.fs.deny` bypass on Windows alternate paths (HIGH) Affected versions: >= 8.0.0 < 8.0.16; >= 7.0.0 < 7.3.5; < 6.4.3 Patched version: 7.3.5 From: example/package.json → `npm/vite@7.1.11` ℹ Read more on: This package \| This alert \| What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/vite@7.1.11`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		High CVE: Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket CVE: GHSA-p9ff-h696-f583 Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket (HIGH) Affected versions: >= 8.0.0 < 8.0.5; >= 7.0.0 < 7.3.2; >= 6.0.0 < 6.4.2 Patched version: 7.3.2 From: example/package.json → `npm/vite@7.1.11` ℹ Read more on: This package \| This alert \| What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/vite@7.1.11`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		High CVE: Vite: `server.fs.deny` bypassed with queries CVE: GHSA-v2wj-q39q-566r Vite: `server.fs.deny` bypassed with queries (HIGH) Affected versions: >= 8.0.0 < 8.0.5; >= 7.1.0 < 7.3.2 Patched version: 7.3.2 From: example/package.json → `npm/vite@7.1.11` ℹ Read more on: This package \| This alert \| What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/vite@7.1.11`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Deprecated by its maintainer: npm `@stellar/stellar-base` Reason: This package is now rolled into @stellar/stellar-sdk. Please use @stellar/stellar-sdk to continue receiving updates and support. From: example/pnpm-lock.yaml → `npm/@stellar/stellar-sdk@14.3.0` → `npm/@stellar/stellar-base@14.0.1` ℹ Read more on: This package \| This alert \| What is a deprecated package? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Research the state of the package and determine if there are non-deprecated versions that can be used, or if it should be replaced with a new, supported solution. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@stellar/stellar-base@14.0.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

github-actions · 2026-04-28T23:08:19Z

🚀 Preview deployed!

Preview URL: https://stellar.github.io/debit-card-reference/pr-preview/pr-4/

This preview will be automatically updated when you push new commits.

github-actions · 2026-04-28T23:33:56Z

🚀 Preview deployed!

Preview URL: https://stellar.github.io/debit-card-reference/pr-preview/pr-4/

The contracts built from this PR are bundled in the preview, so the Deploy New flow works without a local Rust toolchain.

This preview will be automatically updated when you push new commits.

github-actions · 2026-04-28T23:48:29Z

🚀 Preview deployed!

Preview URL: https://stellar.github.io/debit-card-reference/pr-preview/pr-4/

The contracts built from this PR are bundled in the preview, so the Deploy New flow works without a local Rust toolchain.

This preview will be automatically updated when you push new commits.

# Conflicts: # contracts/factory/src/events.rs # contracts/factory/src/lib.rs # contracts/factory/src/test.rs # contracts/issuer/src/lib.rs

Post-audit demo changes so the testnet app can manually verify the findings merged to develop (see post-audit-demo-changes.md): - Owner tab: Destination Allowlist (update_issuer_destination + check) and Rotate Manager (set_authorized_manager) sections — required to exercise the FIND-008 pause carve-out end to end - Global PAUSED/Active badge in the StatusBar, refreshed on tab change and kept in sync by the Pauser tab (pause state lifted into the store) - Pause-semantics copy on Manager/Owner/Pauser/Guide: authority-reducing ops work while paused, authority-adding ops don't (FIND-008) - Velocity field notes + expanded InvalidVelocityConfig message for the on-chain validation rules (FIND-011); no client-side gating so the contract rejection stays observable - Inspector Events section: RPC getEvents with per-event #[topic] filter presets (uuid/account/debitor/issuer_id), cursor pagination across the bounded per-page ledger scan window, decoded results (FIND-010); getEvents added to the logged RPC methods - Inspector Storage TTL section: liveUntilLedgerSeq for both contract instances and the five PersistentKey policy entries, compared against the live network max entry TTL from the state-archival config (FIND-002) - Fixed-window terminology: error #5 message, derived "window resets at" line on velocity queries, Guide flow + boundary-burst caveat; dropped the stale error #10 mapping (FIND-005) - Guide: guided scenarios for the incident-response drill, owner authority chain, and debitor blast-radius bounds (FIND-001/004/008) - LogPane: label contract events by their name symbol Verified against testnet: fresh factory/issuer deployed from post-audit WASM; add-destination while paused rejects with #1000 and removal succeeds while paused; TTL panel shows all entries at latest + max TTL; issuer_created found via issuer_id topic filter (and not with a wrong id). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

github-actions · 2026-07-07T00:38:19Z

🚀 Preview deployed!

Preview URL: https://stellar.github.io/debit-card-reference/pr-preview/pr-4/

The contracts built from this PR are bundled in the preview, so the Deploy New flow works without a local Rust toolchain.

This preview will be automatically updated when you push new commits.

marwen-abid added 4 commits April 13, 2026 11:58

EN-33 Add Ability to Edit Owner, edit Pauser and Upgrade Card Contract

f792c0b

Add Demo app for the Stellar Debit Card Contracts

cb2e164

EN-33 Address PR review feedback

e56c03d

- Split `set_pauser` into `set_pauser_by_owner` / `set_pauser_by_pauser` - Require `new_owner` co-signature on `set_owner` - Extract `require_factory_auth` helper in issuer - Add event assertion tests for `upgrade` and `upgrade_issuer`

EN-33 Cleanup and improve comments

6de113f

marwen-abid force-pushed the feat/add-testnet-demo branch 2 times, most recently from 0e15944 to 323777d Compare April 28, 2026 23:07

marwen-abid marked this pull request as draft April 28, 2026 23:10

marwen-abid changed the title ~~Add Demo app for the Stellar Debit Card Contracts~~ [Draft] Add Demo app for the Stellar Debit Card Contracts Apr 28, 2026

marwen-abid force-pushed the feat/add-testnet-demo branch 2 times, most recently from d873999 to 783a8e7 Compare April 28, 2026 23:32

github-actions Bot pushed a commit that referenced this pull request Apr 28, 2026

Deploy preview for PR #4

de78f44

add workflow to deploy example app on pr-previews

f242455

marwen-abid force-pushed the feat/add-testnet-demo branch from 783a8e7 to f242455 Compare April 28, 2026 23:47

marwen-abid and others added 2 commits July 6, 2026 17:07

Merge remote-tracking branch 'origin/develop' into feat/add-testnet-demo

21e185c

# Conflicts: # contracts/factory/src/events.rs # contracts/factory/src/lib.rs # contracts/factory/src/test.rs # contracts/issuer/src/lib.rs

github-actions Bot pushed a commit that referenced this pull request Jul 7, 2026

Deploy preview for PR #4

447c6a3

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[Draft] Add Demo app for the Stellar Debit Card Contracts#4

[Draft] Add Demo app for the Stellar Debit Card Contracts#4
marwen-abid wants to merge 7 commits into
developfrom
feat/add-testnet-demo

marwen-abid commented Apr 28, 2026

Uh oh!

socket-security Bot commented Apr 28, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Apr 28, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Apr 28, 2026

Uh oh!

github-actions Bot commented Apr 28, 2026

Uh oh!

github-actions Bot commented Apr 28, 2026

Uh oh!

github-actions Bot commented Jul 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

marwen-abid commented Apr 28, 2026

Uh oh!

socket-security Bot commented Apr 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Apr 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Apr 28, 2026

Uh oh!

github-actions Bot commented Apr 28, 2026

Uh oh!

github-actions Bot commented Apr 28, 2026

Uh oh!

github-actions Bot commented Jul 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

socket-security Bot commented Apr 28, 2026 •

edited

Loading

socket-security Bot commented Apr 28, 2026 •

edited

Loading