37a5412f-fb6a-455f-9b9c-3aa8227c255a make share-token metadata immutable

[carrion256]

Fixed Findings

• A-050 / Nexus 37a5412f-fb6a-455f-9b9c-3aa8227c255a — Share-token metadata can be changed after deployment without timelock or event.

Root Cause

The share-token constructor initialized SEP-41 metadata correctly, but the public admin-gated set_metadata(caller, name, symbol, decimals) entrypoint could rewrite name, symbol, and decimals after deployment via Base::set_metadata.

Fix

• Preserve constructor-time metadata initialization.
• Keep the existing set_metadata ABI surface for compatibility, but make post-deployment calls fail after admin authorization with ShareTokenError::MetadataImmutable.
• Add regression coverage proving an authorized admin cannot change metadata after deployment.
• Remove the stale Soroban justfile set-metadata operator recipe/help entry because metadata is now constructor-bound and immutable.

Verification

RED before fix:

RUSTUP_TOOLCHAIN=1.89.0 cargo test -p templar-soroban-share-token admin_cannot_change_metadata_after_deployment -- --nocapture
# FAILED: test did not panic as expected, proving admin metadata mutation was accepted.

GREEN after fix:

RUSTUP_TOOLCHAIN=1.89.0 cargo test -p templar-soroban-share-token admin_cannot_change_metadata_after_deployment -- --nocapture
RUSTUP_TOOLCHAIN=1.89.0 cargo test -p templar-soroban-share-token -- --nocapture
RUSTUP_TOOLCHAIN=1.89.0 cargo fmt --check
git diff --check
just -f contract/vault/soroban/justfile --list | (! rg "set-metadata")
rg -n "Base::set_metadata|pub fn set_metadata|MetadataImmutable" contract/vault/soroban/share-token/src
# Base::set_metadata remains only in constructor; set_metadata now fails with MetadataImmutable.

Post-commit hook:

Soroban size-budget-check passed (93961 bytes)

---

This change is 

Superseded

This A-050-only PR has been folded into the consolidated share-token cluster PR #429.

• Superseding PR: fix(soroban): make share-token vault immutable #429
• Folded commit on fix(soroban): make share-token vault immutable #429 branch: 0aad51e
• Covered finding: A-050 / Nexus 37a5412f-fb6a-455f-9b9c-3aa8227c255a

Closing to keep share-token remediation in PR #429.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: c5d46a9b-5b57-4446-b89d-22fce2bc0c8f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch audit/share-token-metadata-a050

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[carrion256]

Superseded by consolidated share-token cluster PR #429.