[Audit M-02] A shared claim flag destroys one entitlement for dual-role accounts

[hmzakhalid]

Finding

Severity: Medium

Confirmed against baseline commit d4277510d. Requester and provider refunds shared one claimed flag, so an address holding both roles lost its second independent entitlement after its first claim.

Full audit report

Required remediation

Track requester and provider claims separately and test both claim orders for a dual-role account.

The dedicated fixing commit and remediation PR will be linked in a follow-up comment.

[hmzakhalid]

Fixed by commit bcd63fe28050645d51ae9d15a92a9154a5485395 in PR #1727.

[hmzakhalid]

Supersedes the earlier remediation reference after the cleanup of PR #1727. Fixed by commit a670038 (M-02): requester and honest-node claims use independent state.

[hmzakhalid]

Confirmed fixed in final commit 593fcfb. Requester and honest-node entitlements use independent claim state, so dual-role accounts retain both claims.

[hmzakhalid]

Final remediation in PR #1727: 593fcfb separates requester and honest-node claim roles.