@layerzerolabs/ethena-sac-manager-stellar-contracts 1.2.28

package/Cargo.toml

@@ -0,0 +1,38 @@
+[package]
+name = "ethena-sac-manager"
+version = "0.0.1"
+edition = "2021"
+publish = false
+
+[lib]
+crate-type = ["cdylib", "rlib"]
+doctest = false
+
+[features]
+library = []
+testutils = ["soroban-sdk/testutils"]
+
+[dependencies]
+soroban-sdk = { version = "25.1.1", features = ["hazmat-address", "hazmat-crypto"] }
+utils = { path = "dependencies/common-utils-stellar-contracts" }
+common-macros = { path = "dependencies/common-utils-macros-stellar-contracts" }
+sac-manager = { path = "dependencies/sac-manager-stellar-contracts", features = ["library"] }
+cfg-if = { version = "1.0", default-features = false }
+
+[profile.release]
+opt-level = "z"
+overflow-checks = true
+debug = 0
+strip = "symbols"
+debug-assertions = false
+panic = "abort"
+codegen-units = 1
+lto = true
+
+[profile.release-with-logs]
+inherits = "release"
+debug-assertions = true
+
+[dev-dependencies]
+soroban-sdk = { version = "25.1.1", features = ["hazmat-address", "hazmat-crypto", "testutils"] }
+utils = { path = "dependencies/common-utils-stellar-contracts", features = ["testutils"] }

package/LICENSE

@@ -0,0 +1,23 @@
+Copyright (c) 2026 - LayerZero Labs Ltd.
+
+Permission is hereby granted, free of charge, to any
+person obtaining a copy of this software and associated
+documentation files (the "Software"), to deal in the
+Software without restriction, including without
+limitation the rights to use, copy, modify, merge,
+publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software
+is furnished to do so, subject to the following
+conditions:
+The above copyright notice and this permission notice
+shall be included in all copies or substantial portions
+of the Software.
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF
+ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED
+TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
+PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT
+SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR
+IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+DEALINGS IN THE SOFTWARE.

package/clippy.toml

@@ -0,0 +1,6 @@
+# Clippy configuration for Stellar contracts
+
+# Set the too_many_arguments threshold to 11.
+# This aligns with Stellar: contract functions are limited to 10 parameters, plus 1 for 'env'.
+# (Default is 7; raised here to prevent unnecessary clippy warnings on valid contract interfaces.)
+too-many-arguments-threshold = 11

package/package.json

@@ -0,0 +1,43 @@
+{
+  "name": "@layerzerolabs/ethena-sac-manager-stellar-contracts",
+  "version": "1.2.28",
+  "private": false,
+  "license": "MIT",
+  "dependencies": {
+    "@layerzerolabs/common-utils-macros-stellar-contracts": "1.2.28",
+    "@layerzerolabs/common-utils-stellar-contracts": "1.2.28",
+    "@layerzerolabs/sac-manager-stellar-contracts": "1.2.28"
+  },
+  "devDependencies": {
+    "@layerzerolabs/build-utils-rust": "1.2.28",
+    "@layerzerolabs/vm-tooling-stellar": "1.2.28"
+  },
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "externalRepoConfig": {
+    "targets": [
+      "audit-external"
+    ]
+  },
+  "implicitDependencies": {
+    "@layerzerolabs/common-utils-macros-stellar-contracts": "workspace:*",
+    "@layerzerolabs/common-utils-stellar-contracts": "workspace:*",
+    "@layerzerolabs/sac-manager-stellar-contracts": "workspace:*"
+  },
+  "scripts": {
+    "build": "pnpm package:source && pnpm exec lz-tool extra stellar verifiable-build --stellar-version 25.1.0 --archive .artifacts/.incoming/contracts-source.zip --package ethena-sac-manager:Cargo.toml",
+    "build:native": "pnpm resolve-dependencies && pnpm exec lz-tool --docker-platform native stellar contract build --package ethena-sac-manager",
+    "clean": "rm -rf ./dependencies ./target ./node_modules ./.artifacts*",
+    "format": "pnpm exec lz-tool --script \"cargo fmt\" stellar",
+    "format:check": "pnpm exec lz-tool --script \"cargo fmt -- --check\" stellar",
+    "lint": "pnpm resolve-dependencies && pnpm exec lz-tool --script \"cargo fmt -- --check && cargo clippy --all-targets -- -D warnings\" stellar",
+    "lint:fix": "pnpm resolve-dependencies && pnpm exec lz-tool --script \"cargo clippy --all-targets --fix --allow-dirty --allow-staged && cargo fmt\" stellar",
+    "package:source": "pnpm resolve-dependencies && pnpm exec lz-tool extra stellar package-source --output .artifacts/.incoming/contracts-source.zip --exclude 'src/tests/**'",
+    "resolve-dependencies": "pnpm exec build-utils-rust resolve",
+    "test": "pnpm resolve-dependencies && pnpm exec lz-tool --script \"cargo nextest run\" stellar",
+    "test:snapshot:check": "pnpm exec turbo-snapshot check",
+    "test:snapshot:update": "pnpm exec turbo-snapshot update"
+  }
+}

package/rust-toolchain.toml

@@ -0,0 +1,4 @@
+[toolchain]
+channel = "1.90.0"
+targets = ["wasm32v1-none"]
+components = ["rustfmt", "clippy"]

package/rustfmt.toml

@@ -0,0 +1,12 @@
+# Only stable rustfmt options are kept here: the Stellar docker toolchain runs
+# rustfmt on the stable channel (rust 1.90.0), which silently drops unstable
+# options (they only apply on nightly). Do not re-add unstable options unless the
+# tooling is switched to a pinned nightly (see the Solana packages for that setup).
+max_width = 120
+use_field_init_shorthand = true
+use_small_heuristics = "Max"
+
+# style_edition is a stable option honored by the docker toolchain. Pin it to
+# 2021 to match every crate's `edition = "2021"` so formatting stays stable
+# across rustfmt versions (setting it to 2024 would reformat the code).
+style_edition = "2021"

package/src/errors.rs

@@ -0,0 +1,19 @@
+//! Errors for the SAC Manager contract.
+
+use common_macros::contract_error;
+
+/// SAC Manager errors.
+#[contract_error]
+pub enum SACManagerError {
+    /// Account is not blacklisted (required for redistribution).
+    NotBlacklisted,
+    /// Escrow is not configured — redistribution feature is disabled.
+    EscrowNotSet,
+    /// Cannot configure an escrow that is currently blacklisted on the SAC —
+    /// mints to it would revert and break redistribution.
+    EscrowIsBlocked,
+    /// Cannot blacklist (un-authorize) the address that is currently configured
+    /// as the redistribution escrow. Clear the escrow first via
+    /// `set_escrow(None)` if you need to blacklist it.
+    CannotBlockEscrow,
+}

package/src/lib.rs

@@ -0,0 +1,19 @@
+#![no_std]
+
+mod errors;
+
+pub use ::sac_manager::SACAdminWrapper;
+pub use errors::*;
+
+cfg_if::cfg_if! {
+    // Include implementation when NOT in library mode, OR when testutils is enabled (for tests)
+    if #[cfg(any(not(feature = "library"), feature = "testutils"))] {
+        mod storage;
+        mod sac_manager;
+
+        pub use sac_manager::{SACManager, SACManagerClient};
+    }
+}
+
+#[cfg(test)]
+mod tests;

package/src/sac_manager.rs

@@ -0,0 +1,262 @@
+//! SAC Manager Contract - Manages a Stellar Asset Contract (SAC) as its admin.
+//!
+//! This contract becomes the admin of a SAC and provides:
+//! - Mintable interface for OFT (mint on credit only; OFT burns on the token directly)
+//! - Role-based access control operations (clawback, set_admin, set_authorized)
+//! - **Optional** redistribution feature, toggled by configuring an escrow address.
+//!
+//! ## Trust Model Requirement
+//!
+//! **The issuer account must be locked (master weight set to 0).** In Stellar classic assets,
+//! transfers from/to the issuer are equivalent to minting/burning. The issuer can always mint
+//! more tokens and perform other classic operations directly, even when an explicit admin (this
+//! contract) is set. If the issuer account is not locked, the RBAC model enforced by this
+//! contract can be bypassed, breaking the trust model.
+//!
+//! ## Authorization Model
+//!
+//! - **Owner** (via Ownable): The deployer/admin address. Can manage TTL,
+//!   grant/revoke roles, and configure the redistribution escrow (`set_escrow`).
+//! - **RBAC roles**: Access is enforced by role.
+//!   - `ADMIN_MANAGER_ROLE`: set_admin
+//!   - `MINTER_ROLE`: mint (e.g. for OFT credit)
+//!   - `BLACKLISTER_ROLE`: set_authorized
+//!   - `CLAWBACK_ROLE`: clawback
+//!   - `REDISTRIBUTOR_ROLE`: redistribute_blacklisted_funds
+//!
+//! ## Redistribution Feature
+//!
+//! Redistribution is **opt-in** via the escrow address:
+//!
+//! - When the escrow is `None` (default), the contract behaves like a plain SAC admin
+//!   wrapper. Mints to blacklisted accounts revert at the SAC layer; no redirection
+//!   occurs and `redistribute_blacklisted_funds` is unavailable.
+//! - When the escrow is `Some(address)`, the redistribution feature is enabled:
+//!   - `mint(to, ...)` to a blacklisted recipient is silently redirected to the escrow.
+//!   - A `REDISTRIBUTOR_ROLE` holder may call `redistribute_blacklisted_funds(from, amount)`
+//!     to claw back from a blacklisted account and re-mint to the escrow.
+//!
+//! ### Escrow Constraint (caller-enforced invariant)
+//!
+//! **The escrow account MUST NOT be the underlying classic asset issuer.** In Stellar,
+//! the asset issuer cannot hold a trustline to its own asset, so any mint to the issuer
+//! would revert at the SAC layer and break redistribution. This invariant is not
+//! enforced on-chain; the owner is responsible for verifying it off-chain (see
+//! `set_escrow` for the rationale).
+//!
+//! `set_escrow` does, however, refuse to configure an escrow that is currently
+//! blacklisted on the SAC (`EscrowIsBlocked`), and `set_authorized` refuses to
+//! blacklist the address that is currently configured as the escrow
+//! (`CannotBlockEscrow`). These on-chain guards keep the redistribution path live
+//! once enabled.
+//!
+//! ### SAC Auth Mode Assumption (when redistribution is enabled)
+//!
+//! The underlying SAC is expected to be configured with the following issuer flags:
+//! - `AUTH_CLAWBACK_ENABLED`: allows clawback of tokens from any account
+//! - `AUTH_REVOCABLE`: allows revoking authorization (blacklisting) from accounts
+//! - `AUTH_REQUIRED` **must** be set to `false` (blacklist mode) — all accounts are
+//!   authorized by default, and only explicitly deauthorized accounts are blocked.
+//!   This is critical for the redistribution logic: if `AUTH_REQUIRED` were `true`
+//!   (allowlist mode), every new account would start as unauthorized, causing every
+//!   mint to be redirected to the escrow.
+
+use crate::{errors::SACManagerError, storage::SACManagerStorage};
+use common_macros::{contract_impl, lz_contract, only_auth, only_role};
+use sac_manager::SACAdminWrapper;
+use soroban_sdk::{assert_with_error, contractevent, token::StellarAssetClient, Address, Env};
+use utils::{option_ext::OptionExt, rbac::RoleBasedAccessControl};
+
+/// Role that can set the admin
+const ADMIN_MANAGER_ROLE: &str = "ADMIN_MANAGER_ROLE";
+/// Role that can mint tokens
+const MINTER_ROLE: &str = "MINTER_ROLE";
+/// Role that can blacklist users
+const BLACKLISTER_ROLE: &str = "BLACKLISTER_ROLE";
+/// Role that can clawback tokens from users
+const CLAWBACK_ROLE: &str = "CLAWBACK_ROLE";
+/// Role that can execute redistribution (redistribute_blacklisted_funds).
+/// Configuring the escrow itself is owner-gated (see `set_escrow`).
+const REDISTRIBUTOR_ROLE: &str = "REDISTRIBUTOR_ROLE";
+
+// =========================================================================
+// Redistribution (events)
+// =========================================================================
+
+/// Event emitted when the redistribution escrow is set or cleared.
+#[contractevent]
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct EscrowSet {
+    pub previous_escrow: Option<Address>,
+    pub new_escrow: Option<Address>,
+}
+
+/// Event emitted when funds are redistributed from a blacklisted account
+/// (either via the auto-redirect in `mint` or via `redistribute_blacklisted_funds`).
+#[contractevent]
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct RedistributeFunds {
+    #[topic]
+    pub user: Address,
+    #[topic]
+    pub escrow: Address,
+    pub amount: i128,
+}
+
+// =========================================================================
+// SAC Manager Contract
+// =========================================================================
+
+/// SAC Manager Contract
+///
+/// Manages a SAC as its admin, forwarding token actions to the underlying SAC
+/// while enforcing access control and (optionally) redirecting mints away from
+/// blacklisted accounts to a configured escrow.
+#[lz_contract]
+pub struct SACManager;
+
+#[contract_impl]
+impl SACManager {
+    /// Constructs the SAC manager contract.
+    ///
+    /// # Arguments
+    /// * `sac_token` - The underlying Stellar Asset Contract address
+    /// * `owner` - The initial owner address (for TTL management, role grants)
+    pub fn __constructor(env: &Env, sac_token: &Address, owner: &Address) {
+        Self::init_owner(env, owner);
+        SACManagerStorage::set_sac_token(env, sac_token);
+    }
+
+    /// Returns the underlying SAC (Stellar Asset Contract) address.
+    pub fn underlying_sac(env: &Env) -> Address {
+        SACManagerStorage::sac_token(env).unwrap()
+    }
+
+    /// Returns the currently configured escrow address, if any.
+    ///
+    /// `None` means the redistribution feature is disabled.
+    pub fn escrow(env: &Env) -> Option<Address> {
+        SACManagerStorage::escrow(env)
+    }
+
+    // =========================================================================
+    // Redistribution configuration
+    // =========================================================================
+
+    /// Sets (or clears) the escrow address that receives redistributed funds.
+    ///
+    /// Pass `Some(address)` to enable the redistribution feature, or `None` to
+    /// disable it. Callable only by the owner.
+    ///
+    /// When setting a new escrow, the address must not be currently blacklisted
+    /// on the SAC, otherwise the call reverts with `EscrowIsBlocked`. Emits an
+    /// `EscrowSet` event with the previous and new values.
+    ///
+    /// # Escrow Constraint
+    ///
+    /// **The escrow MUST NOT be the underlying classic asset issuer.** Stellar
+    /// asset issuers cannot hold trustlines to their own asset, so any
+    /// redistribution mint to the issuer would revert at the SAC layer.
+    ///
+    /// The SAC exposes no direct getter for the classic issuer, though it can be
+    /// derived sideways from the asset name (format `{asset_code}:{issuer_address}`).
+    /// This contract deliberately does not enforce the invariant on-chain — the
+    /// name-parsing check is brittle (asset code length, strkey format) — so
+    /// **the owner calling this function is responsible for verifying off-chain** that
+    /// the configured escrow is not the issuer account.
+    #[only_auth]
+    pub fn set_escrow(env: &Env, escrow: &Option<Address>) {
+        if let Some(addr) = escrow {
+            assert_with_error!(env, sac_client(env).authorized(addr), SACManagerError::EscrowIsBlocked);
+        }
+        let previous_escrow = Self::escrow(env);
+        SACManagerStorage::set_or_remove_escrow(env, escrow);
+        EscrowSet { previous_escrow, new_escrow: escrow.clone() }.publish(env);
+    }
+
+    // =========================================================================
+    // Redistribution action
+    // =========================================================================
+
+    /// Redistributes funds from a blacklisted account to the configured escrow.
+    ///
+    /// Requires:
+    /// - Operator with `REDISTRIBUTOR_ROLE`.
+    /// - An escrow has been configured by the owner (`set_escrow(Some(_))`).
+    /// - `from` is currently blacklisted on the underlying SAC.
+    #[only_role(operator, REDISTRIBUTOR_ROLE)]
+    pub fn redistribute_blacklisted_funds(env: &Env, from: &Address, amount: i128, operator: &Address) {
+        let sac = sac_client(env);
+        let escrow = Self::escrow(env).unwrap_or_panic(env, SACManagerError::EscrowNotSet);
+        assert_with_error!(env, !sac.authorized(from), SACManagerError::NotBlacklisted);
+
+        // Clawback + mint must both succeed for the redistribution to be atomic.
+        // See the escrow/issuer constraint in `set_escrow` docs — if the escrow
+        // is misconfigured to the classic asset issuer, the mint will revert and
+        // the clawback will roll back with it.
+        sac.clawback(from, &amount);
+        sac.mint(&escrow, &amount);
+
+        RedistributeFunds { user: from.clone(), escrow, amount }.publish(env);
+    }
+}
+
+#[contract_impl(contracttrait)]
+impl SACAdminWrapper for SACManager {
+    #[only_role(operator, ADMIN_MANAGER_ROLE)]
+    fn set_admin(env: &Env, new_admin: &Address, operator: &Address) {
+        sac_client(env).set_admin(new_admin);
+    }
+
+    /// Blacklists (`authorize=false`) or re-authorizes (`authorize=true`) an
+    /// address on the underlying SAC.
+    ///
+    /// Refuses to blacklist the address currently configured as the
+    /// redistribution escrow — clear the escrow first via `set_escrow(None)`
+    /// to ensure the redistribution path stays live.
+    #[only_role(operator, BLACKLISTER_ROLE)]
+    fn set_authorized(env: &Env, id: &Address, authorize: bool, operator: &Address) {
+        assert_with_error!(
+            env,
+            authorize || Self::escrow(env).as_ref() != Some(id),
+            SACManagerError::CannotBlockEscrow
+        );
+        sac_client(env).set_authorized(id, &authorize);
+    }
+
+    #[only_role(operator, CLAWBACK_ROLE)]
+    fn clawback(env: &Env, from: &Address, amount: i128, operator: &Address) {
+        sac_client(env).clawback(from, &amount);
+    }
+
+    /// Mints `amount` to `to`.
+    ///
+    /// If the redistribution feature is enabled (escrow set) and `to` is
+    /// blacklisted on the SAC, the mint is silently redirected to the escrow
+    /// and a `RedistributeFunds` event is emitted. Otherwise the mint is
+    /// forwarded as-is to the SAC.
+    #[only_role(operator, MINTER_ROLE)]
+    fn mint(env: &Env, to: &Address, amount: i128, operator: &Address) {
+        let sac = sac_client(env);
+        match Self::escrow(env) {
+            Some(escrow_addr) if !sac.authorized(to) => {
+                sac.mint(&escrow_addr, &amount);
+                RedistributeFunds { user: to.clone(), escrow: escrow_addr, amount }.publish(env);
+            }
+            _ => {
+                sac.mint(to, &amount);
+            }
+        }
+    }
+}
+
+#[contract_impl(contracttrait)]
+impl RoleBasedAccessControl for SACManager {}
+
+// =========================================================================
+// Helper Functions
+// =========================================================================
+
+fn sac_client(env: &Env) -> StellarAssetClient<'_> {
+    StellarAssetClient::new(env, &SACManager::underlying_sac(env))
+}

package/src/storage.rs

@@ -0,0 +1,18 @@
+//! Storage definitions for the SAC manager contract.
+//!
+//! This file contains the core storage.
+
+use common_macros::storage;
+use soroban_sdk::Address;
+
+#[storage]
+pub enum SACManagerStorage {
+    /// The underlying SAC (Stellar Asset Contract) address
+    #[instance(Address)]
+    SacToken,
+    /// Escrow address that receives funds redistributed away from blacklisted
+    /// accounts. Presence of this value enables the redistribution feature;
+    /// absence disables it.
+    #[instance(Address)]
+    Escrow,
+}

package/src/tests/mod.rs

@@ -0,0 +1,8 @@
+//! SAC Manager contract tests.
+//!
+//! - `sac_manager`: Admin ops (RBAC), clawback, mint (including redistribution redirect),
+//!   set_authorized, set_admin, view functions, redistribute_blacklisted_funds.
+
+mod test_helper;
+
+mod sac_manager;

package/src/tests/sac_manager/clawback.rs

@@ -0,0 +1,85 @@
+//! Clawback Integration Tests
+//!
+//! Operator must hold CLAWBACK_ROLE. SAC must have AUTH_CLAWBACK_ENABLED.
+
+use super::test_helper::mock_clawback_auth;
+use crate::tests::test_helper::{mock_oft_mint_auth, TestSetup};
+use soroban_sdk::testutils::IssuerFlags;
+use utils::errors::RbacError;
+
+// =========================================================================
+// clawback Tests
+// =========================================================================
+
+#[test]
+fn test_clawback_by_owner() {
+    let setup = TestSetup::new().with_manager_as_sac_admin().build();
+    let user = setup.generate_address();
+
+    setup.sac_contract.issuer().set_flag(IssuerFlags::RevocableFlag);
+    setup.sac_contract.issuer().set_flag(IssuerFlags::ClawbackEnabledFlag);
+
+    mock_oft_mint_auth(&setup, &user, 1000_i128);
+    setup.sac_manager_client.mint(&user, &1000, &setup.minter);
+    assert_eq!(setup.sac_client.balance(&user), 1000);
+
+    mock_clawback_auth(&setup, &setup.owner, &user, 500_i128);
+    setup.sac_manager_client.clawback(&user, &500, &setup.owner);
+    assert_eq!(setup.sac_client.balance(&user), 500);
+}
+
+#[test]
+fn test_clawback_full_balance() {
+    let setup = TestSetup::new().with_manager_as_sac_admin().build();
+    let user = setup.generate_address();
+
+    setup.sac_contract.issuer().set_flag(IssuerFlags::RevocableFlag);
+    setup.sac_contract.issuer().set_flag(IssuerFlags::ClawbackEnabledFlag);
+
+    mock_oft_mint_auth(&setup, &user, 1000_i128);
+    setup.sac_manager_client.mint(&user, &1000, &setup.minter);
+
+    mock_clawback_auth(&setup, &setup.owner, &user, 1000_i128);
+    setup.sac_manager_client.clawback(&user, &1000, &setup.owner);
+    assert_eq!(setup.sac_client.balance(&user), 0);
+}
+
+#[test]
+fn test_clawback_fails_when_amount_exceeds_balance() {
+    let setup = TestSetup::new().with_manager_as_sac_admin().build();
+    let user = setup.generate_address();
+
+    setup.sac_contract.issuer().set_flag(IssuerFlags::RevocableFlag);
+    setup.sac_contract.issuer().set_flag(IssuerFlags::ClawbackEnabledFlag);
+
+    mock_oft_mint_auth(&setup, &user, 100_i128);
+    setup.sac_manager_client.mint(&user, &100, &setup.minter);
+
+    mock_clawback_auth(&setup, &setup.owner, &user, 200_i128);
+    let result = setup.sac_manager_client.try_clawback(&user, &200, &setup.owner);
+    assert!(result.is_err());
+}
+
+#[test]
+fn test_clawback_operator_without_role_fails() {
+    let setup = TestSetup::new().with_manager_as_sac_admin().build();
+    let user = setup.generate_address();
+    let random = setup.generate_address();
+
+    mock_clawback_auth(&setup, &random, &user, 500_i128);
+    let result = setup.sac_manager_client.try_clawback(&user, &500, &random);
+    assert_eq!(result.err().unwrap().unwrap(), RbacError::Unauthorized.into());
+}
+
+// =========================================================================
+// clawback Auth Tests
+// =========================================================================
+
+#[test]
+#[should_panic(expected = "Error(Auth, InvalidAction)")]
+fn test_clawback_fails_without_auth() {
+    let setup = TestSetup::new().build();
+    let user = setup.generate_address();
+
+    setup.sac_manager_client.clawback(&user, &300, &setup.owner);
+}

package/src/tests/sac_manager/mint.rs

@@ -0,0 +1,103 @@
+//! Mint (Mintable) Integration Tests
+//!
+//! Operator must hold MINTER_ROLE and authorize the call.
+//! When the redistribution feature is enabled (escrow set) and the recipient
+//! is blacklisted, funds are silently redirected to the escrow.
+
+use super::test_helper::mock_set_authorized_auth;
+use crate::sac_manager::RedistributeFunds;
+use crate::tests::test_helper::{mock_auth, mock_oft_mint_auth, TestSetup};
+use soroban_sdk::testutils::IssuerFlags;
+use utils::{errors::RbacError, testing_utils::assert_contains_event};
+
+// =========================================================================
+// Mint success — operator with MINTER_ROLE calls mint
+// =========================================================================
+
+#[test]
+fn test_mint_by_minter() {
+    let setup = TestSetup::new().with_manager_as_sac_admin().build();
+    let recipient = setup.generate_address();
+
+    mock_oft_mint_auth(&setup, &recipient, 1000_i128);
+    setup.sac_manager_client.mint(&recipient, &1000, &setup.minter);
+    assert_eq!(setup.sac_client.balance(&recipient), 1000);
+}
+
+// =========================================================================
+// Mint redirect — escrow set + recipient blacklisted -> escrow receives funds
+// =========================================================================
+
+#[test]
+fn test_mint_redistributes_when_recipient_blacklisted_and_escrow_set() {
+    let setup = TestSetup::new().with_manager_as_sac_admin().with_escrow_enabled().build();
+    let escrow = setup.escrow.clone().unwrap();
+    let blacklisted_recipient = setup.generate_address();
+
+    setup.sac_contract.issuer().set_flag(IssuerFlags::RevocableFlag);
+    setup.sac_contract.issuer().set_flag(IssuerFlags::ClawbackEnabledFlag);
+
+    mock_set_authorized_auth(&setup, &setup.owner, &blacklisted_recipient, false);
+    setup.sac_manager_client.set_authorized(&blacklisted_recipient, &false, &setup.owner);
+    assert!(!setup.sac_client.authorized(&blacklisted_recipient));
+
+    let escrow_balance_before = setup.sac_client.balance(&escrow);
+    let blacklisted_balance_before = setup.sac_client.balance(&blacklisted_recipient);
+
+    mock_oft_mint_auth(&setup, &blacklisted_recipient, 700_i128);
+    setup.sac_manager_client.mint(&blacklisted_recipient, &700, &setup.minter);
+
+    let expected = RedistributeFunds { user: blacklisted_recipient.clone(), escrow: escrow.clone(), amount: 700 };
+    assert_contains_event(&setup.env, &setup.sac_manager, expected);
+
+    assert_eq!(setup.sac_client.balance(&blacklisted_recipient), blacklisted_balance_before);
+    assert_eq!(setup.sac_client.balance(&escrow), escrow_balance_before + 700);
+}
+
+// =========================================================================
+// Mint without escrow — escrow disabled, mint to blacklisted account fails
+// at the SAC layer (no redirection happens).
+// =========================================================================
+
+#[test]
+fn test_mint_to_blacklisted_without_escrow_fails() {
+    let setup = TestSetup::new().with_manager_as_sac_admin().build();
+    let blacklisted_recipient = setup.generate_address();
+
+    setup.sac_contract.issuer().set_flag(IssuerFlags::RevocableFlag);
+
+    mock_set_authorized_auth(&setup, &setup.owner, &blacklisted_recipient, false);
+    setup.sac_manager_client.set_authorized(&blacklisted_recipient, &false, &setup.owner);
+
+    mock_oft_mint_auth(&setup, &blacklisted_recipient, 500_i128);
+    let result = setup.sac_manager_client.try_mint(&blacklisted_recipient, &500, &setup.minter);
+    assert!(result.is_err());
+}
+
+// =========================================================================
+// Mint role auth — operator without MINTER_ROLE fails
+// =========================================================================
+
+#[test]
+fn test_mint_operator_without_role_fails() {
+    let setup = TestSetup::new().with_manager_as_sac_admin().build();
+    let recipient = setup.generate_address();
+    let random = setup.generate_address();
+
+    mock_auth(&setup.env, &setup.sac_manager, &random, "mint", (&recipient, 1000_i128, &random));
+    let result = setup.sac_manager_client.try_mint(&recipient, &1000, &random);
+    assert_eq!(result.err().unwrap().unwrap(), RbacError::Unauthorized.into());
+}
+
+// =========================================================================
+// Mint auth — operator must authorize
+// =========================================================================
+
+#[test]
+#[should_panic(expected = "Error(Auth, InvalidAction)")]
+fn test_mint_fails_without_minter_auth() {
+    let setup = TestSetup::new().with_manager_as_sac_admin().build();
+    let recipient = setup.generate_address();
+
+    setup.sac_manager_client.mint(&recipient, &1000, &setup.minter);
+}

package/src/tests/sac_manager/mod.rs

@@ -0,0 +1,8 @@
+mod clawback;
+mod mint;
+mod redistribute_funds;
+mod set_admin;
+mod set_authorized;
+mod set_escrow;
+mod test_helper;
+mod view_functions;