Fix governance auth before command decode

[carrion256]

Fixed Findings

• A-056 / Nexus 4ca30771-41fc-4b53-b8b2-95168b12803d

Summary

• Stack on Governance ABI/validation cleanup PR fix: require governance group market id #441.
• Move the runtime execute_governance authorization boundary ahead of governance command body decode.
• Keep the public ABI unchanged.
• Remove duplicate private governance-command auth after the bridge has authenticated the governance caller, avoiding double require_auth failures while preserving direct public governance guards outside the bridge.

Root Cause

SorobanVaultContract::execute_governance decoded the full governance command payload before checking that caller was the configured governance contract. Unauthorized callers could therefore force command-body decode/allocation before the call failed.

Verification

RED before fix:

• cargo test -p templar-soroban-runtime test_execute_governance_unauthorized_caller_rejected_before_body_decode -- --nocapture
  • Failed with left: Err(InvalidInput), right: Err(Unauthorized), proving the malformed body decoded/failed before authorization.

GREEN after fix:

• cargo test -p templar-soroban-runtime test_execute_governance_unauthorized_caller_rejected_before_body_decode -- --nocapture
• cargo test -p templar-soroban-runtime test_execute_governance_group_membership_requires_market_id -- --nocapture
• cargo test -p templar-soroban-runtime --lib -- --nocapture
• cargo test -p templar-soroban-runtime -- --nocapture
• cargo fmt --check
• git diff --check
• just -f contract/vault/soroban/justfile build
• just -f contract/vault/soroban/justfile size-budget-check
  • Runtime deploy WASM: 93782 bytes / 91.58 KiB <= 131072 bytes / 128.00 KiB

Stack

• Base: audit/governance-abi-validation-a062 / PR fix: require governance group market id #441
• This PR: audit/governance-abi-validation-a056

---

This change is 

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: ff966454-8854-4799-94b5-686052ffa357

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch audit/governance-abi-validation-a056

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[carrion256]

Superseded by consolidated governance control-plane PR #427. The relevant commits/findings from this PR have been folded into #427 and verified there.

[carrion256]

Closed as superseded by consolidated governance control-plane PR #427.