feat(contract): Soroban item token and inventory shop (#15)

[s6pa1rta3n-lab]

Fixes #15

Payout Routing

• EVM (Base/Arbitrum/Polygon/ETH): 0xF46C9F6d70C50BF81ef3588AB523a90a594a2F89
• Stellar: GCL6OXAMLD75BMTINA6EMRUDWK5THQUSHMYNLSNBCJAPZJHNYJTUNIBC

---

Summary by Gitar

• New Soroban item token and inventory shop contract:
  • Added runa_item_token contract with support for item registration, minting, burning, and transferring
  • Enforced level and gold gating with robust test coverage including adversarial test suites

_{This will update automatically on new commits.}

[s6pa1rta3n-lab]

I've resolved the review findings:

1. Removed runa_common workspace dependency from contracts/runa_item_token and added local ItemMetadata, InventorySummary, and ItemError types so the crate builds and passes tests standalone.
2. Added admin.require_auth(); to the beginning of the initialize() function.
3. Updated transfer_item() to validate that the item exists and that the from address holds a balance before checking for self-transfers.

All tests are now passing successfully.

[gitar-bot]

Code Review ✅ Approved 3 resolved / 3 findings

Introduces the Soroban item token and inventory shop contract with level and gold gating, addressing the missing runa_common crate, unauthenticated initialize(), and self-transfer findings.

✅ 3 resolved

✅ Bug: Contract depends on missing runa_common crate / workspace

📄 contracts/runa_item_token/Cargo.toml:10-11 📄 contracts/runa_item_token/src/lib.rs:9 📄 contracts/runa_item_token/src/errors.rs:1
lib.rs, errors.rs and the tests import runa_common::{InventorySummary, ItemError, ItemMetadata}, and Cargo.toml declares runa_common = { workspace = true } and soroban-sdk = { workspace = true }. However there is no runa_common crate anywhere in the repo and no root/workspace Cargo.toml defining [workspace] (only the standalone contracts/duel-arena/Cargo.toml exists). As written this crate cannot resolve workspace = true nor the runa_common dependency, so it will fail to build. Add the runa_common crate (with ItemError, ItemMetadata, InventorySummary) and a workspace root that includes it, or point the dependency at a concrete path/version.

✅ Security: initialize() lacks auth; enables admin takeover front-run

📄 contracts/runa_item_token/src/lib.rs:38-52
initialize sets Admin and AuthorizedGameContract without any require_auth(), guarding only against re-initialization via has(Admin). After deployment, any party can call initialize first and set themselves as admin and authorized game contract, then use register_item (admin-gated) and control minting. Require authorization from the deploying party, e.g. admin.require_auth(); at the start of initialize, or bind the admin during contract construction.

✅ Bug: Self-transfer succeeds even without ownership

📄 contracts/runa_item_token/src/lib.rs:232-236
transfer_item returns Ok(()) immediately when from == to, before verifying the item exists or that from holds a balance. A caller can invoke a self-transfer of an item they do not own (or a nonexistent item) and get a success result plus, if reached, TTL side effects are skipped but the no-op still masks invalid input. Consider validating item existence and balance before the from == to short-circuit, or documenting the no-op semantics explicitly.

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

---

Important

Your trial ends in 6 days — upgrade now to keep code review, CI analysis, auto-apply, custom automations, and more.

_{Was this helpful? React with 👍 / 👎 | Gitar}