Instawards: pay_batch SAC settlement, Ed25519 oracle hardening, Bulk Pay dashboard

[r-json]

Deliverables 1–3 of the 30-day Instawards sprint, validated on Stellar Testnet.

Contract: CCVIQZLSJIPSCFH2QGPKN5IOAA5ZQ4DOD4HLBZFMYKXPRAMCIOZGFJDF

Reviewer evidence

Artifact	Location
Testnet validation	docs/evidence/TESTNET_VALIDATION.md
50 transaction hashes	docs/evidence/all_50_hashes.txt
Developer guide	docs/DEVELOPER_GUIDE.md
Demo video checklist	docs/evidence/DEMO_VIDEO_CHECKLIST.md

Representative transactions:

• pay_batch — USDC + XLM in one transaction
• pay_batch — dual-signed by two distinct keys
• finance_approve — separate finance key
• rotate_oracle_key
• Contract deploy

D1 — Token transfer integration

PaymentSchedule carries a per-payee token: Address, so one batch settles multiple assets. Custody is funded and refunded per distinct asset (one transfer per token, not per payee). pay_batch replaces finalize_payment, which remains as a delegating alias so the live Mainnet ABI and existing client keep working.

Verified on Testnet: custody funded with two transfers (500000000 USDC + 100000000 native), settled with two transfers, custody drained to 0 in both assets.

D2 — Ed25519 oracle verification

• Signature is verified before the nonce is consumed. Previously a garbage signature could burn an escrow's nonce sequence.
• pay_batch returns ProofMissing unless every payment carries a verified attestation. Both approvals could previously settle a batch with zero oracle attestations — the "funds move only against proof of work" property was procedural, not enforced.
• rotate_oracle_key revokes previously verified proofs, since rotation implies the retired key may be compromised.
• SignersNotDistinct rejects manager == finance_approver at creation and settlement.
• scripts/oracle-cli.mjs signs the 32-byte per-payment message, one signature per payee with sequential nonces.

D3 — Bulk Pay dashboard

/bulk-pay: CSV upload, payee preview, role-based dual signing, transaction status.

Approval badges read on-chain state via get_escrow, not React state. manager_approve and finance_approve are separate on-chain transactions; local state would render green with no on-chain approval and settlement would fail with #5.

Build fix (was blocking, pre-existing)

The contract could not be deployed at all before this PR:

HostError: Error(WasmVm, InvalidAction)
"reference-types not enabled: zero byte expected"

rustc 1.85 emits reference-types into wasm32-unknown-unknown. Fixed by targeting wasm32v1-none. rust-toolchain.toml pins 1.85.0 — the only version that works, since soroban-sdk 20.5.0 fails to compile on newer rustc (ethnum E0512) and fails to resolve on older cargo (zeroize edition2024).

CI

Adds a Rust job (cargo test --locked + wasm32v1-none build). No Rust test has ever run in CI. Trigger extended to instawards/**, without which this branch never builds.

Tests

Suite	Before	After
Rust	29	40
TypeScript	79	79

Includes a cross-language conformance test asserting the CLI's signature bytes are accepted on-chain, so encoding drift fails in CI rather than as an opaque Testnet rejection.

Not yet done

• The Freighter signing path has never been executed in a browser. Compile-verified only; needs manual validation before the demo video.
• Demo video not recorded.
• Negative cases (#5, #15, retired-key rejection) are simulation-rejected and have no on-chain hashes — reviewers reproduce them by re-running the documented commands.
• ESCROW_ID is hardcoded in /bulk-pay; should become a selector.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
coreflow	Ready	Preview	Sep 5, 2026 12:39pm UTC