hard: liquidity pool blindly pays any merchant address the creditline…

[BigMick03]

Closes #89

Pull Request

Description

Brief description of changes made in this PR.

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update

Changes Made

• List main changes here

Testing

• Tests pass locally
• New tests added (if applicable)

Checklist

• Code follows project style guidelines
• Self-review completed
• Comments added for complex code
• Documentation updated
• No new warnings generated

[EmeditWeb]

⚠️ Automated Audit: partial

@BigMick03 Good start — please look into the gaps identified below.

The PR implements all five requirements from issue #89 at the root-cause level: a per-ledger outflow cap with a rolling window that resets on ledger sequence change, a persistent per-merchant concentration cap with TTL extension, a fail-closed optional vendor cross-check via try_invoke_contract gated by an admin-only setter (which the issue explicitly permits as an alternative to initialize()), and an extended LQFUND event with merchant topic and remaining-cap fields. All new setters follow the require_auth() + require_admin pattern, caps default to disabled to preserve honest flows exactly as the issue's backward-compatibility requirement demands, and 18 targeted regression tests were added covering repeated-call capping, window resets, setter guards, vendor modes, and unchanged legacy behavior. Caveat: the PR description's claimed results (113/356 tests green) are unverified — the independent sandbox run was skipped and no CI is configured — so pass/fail of the suite rests solely on code inspection, which found no logic flaws (failed invocations revert storage wholesale, so the persist-before-later-check ordering is harmless).

⚖️ Adjusted by bot policy: confidence 78% is below the 90% threshold for a full approval.

---

CI checks: none configured
Merge conflicts: none, but the PR is blocked (failing/missing required checks or reviews).

_{Audited by stepfi-audit-bot 🤖}

[EmeditWeb]

⚠️ Automated Audit: partial

@BigMick03 Good start — please look into the gaps identified below.

The PR directly implements all three defense-in-depth layers requested in issue #89: per-ledger outflow cap with rolling window reset, single-recipient concentration cap with persistent per-merchant tracking, and optional vendor registry cross-check (fail-closed via try_invoke_contract). Events are extended with merchant address and remaining cap headroom. All admin setters use require_auth + require_admin. CI passed (build + test contracts green). The 18 new tests cover cap enforcement, window resets, backward-compatible defaults, admin guards, vendor check in enabled/disabled/cleared modes, and event payloads — all independently verified. The merchant_total storage is only written when the cap is active, avoiding unnecessary state growth.

⚖️ Adjusted by bot policy: gaps were still identified.

Gaps identified:

• PR description is a boilerplate template with placeholder text ('List main changes here', empty checklist items) — the substantive content exists only in the progress-tracker update. Should be cleaned up for traceability.
• Fix merge conflicts

---

CI checks: ✅ PASSED: Build and Test Contracts

_{Audited by stepfi-audit-bot 🤖}