Harden Soroban executor

stellar/Cargo.toml

@@ -9,7 +9,7 @@ members = [
 edition = "2024"
 
 [workspace.dependencies]
-soroban-sdk = "25.1.1"
+soroban-sdk = "27.0.0"
 executor-soroban-client = { path = "contracts/executor-soroban-client" }
 
 [profile.release]

stellar/contracts/executor-soroban-client/src/error.rs

@@ -9,15 +9,17 @@ use soroban_sdk::contracterror;
 #[derive(Copy, Clone, Debug, Eq, PartialEq, PartialOrd, Ord)]
 #[repr(u32)]
 pub enum ExecutorError {
-    /// The `SignedQuote::expiry` is less than or equal to the current ledger
-    /// timestamp at the time of the call.
+    /// The quote header's `expiryTime` is less than or equal to the current
+    /// ledger timestamp at the time of the call.
     QuoteExpired = 11,
-    /// The `SignedQuote::src_chain` does not match the Wormhole chain id
+    /// The quote header's `srcChain` does not match the Wormhole chain id
     /// configured at construction.
     QuoteSrcChainMismatch = 12,
-    /// The `SignedQuote::dst_chain` does not match the `dst_chain` argument
+    /// The quote header's `dstChain` does not match the `dst_chain` argument
     /// passed to `request_execution`.
     QuoteDstChainMismatch = 13,
     /// The `amount` argument passed to `request_execution` is negative.
     InvalidAmount = 14,
+    /// The signed quote is shorter than the 68-byte header.
+    InvalidQuote = 15,
 }

stellar/contracts/executor-soroban-client/src/lib.rs

@@ -5,53 +5,54 @@
 
 #![no_std]
 
-pub mod constants;
 pub mod error;
-pub mod types;
 
-pub use constants::*;
 pub use error::ExecutorError;
-pub use types::*;
 
 use soroban_sdk::{Address, Bytes, BytesN, Env, String, contractclient};
 
 /// Public interface for the Wormhole Executor contract.
 ///
-/// The Executor is a prepaid cross-chain delivery payment rail. A `payer`
-/// submits a [`SignedQuote`] alongside a delivery request, the contract
-/// validates the quote, transfers the agreed `amount` of native token from
-/// the payer to the quote's `payee`, and emits an event consumed by off-chain
+/// The Executor is a stateless, permissionless cross-chain delivery payment
+/// rail. A `payer` submits an off-chain-signed quote (as opaque bytes)
+/// alongside a delivery request, the contract validates the quote header,
+/// transfers the agreed `amount` of native token from the payer to the
+/// `payee`, and emits an event carrying the full quote verbatim for off-chain
 /// relayers that fulfill the delivery on the destination chain.
 ///
-/// # Quote authentication is NOT performed on-chain
+/// # Quote authentication and payee binding are OFF-CHAIN
 ///
-/// Despite its name, [`SignedQuote`] is not verified by the Executor. Neither
-/// the [`SignedQuote::prefix`] domain tag nor the `quoter`'s signature over
-/// the quote are checked on chain. Quote authentication is a caller-side
-/// responsibility, performed off-chain before the transaction is submitted.
+/// The contract parses only the 68-byte quote header (chain ids and expiry).
+/// It does not verify the quote's signature, nor does it bind `payee` to the
+/// payee encoded in the quote header — both are the relayer's off-chain
+/// responsibility, which the verbatim-emitted quote enables.
 #[contractclient(name = "ExecutorClient")]
 pub trait ExecutorInterface {
     /// Returns the Wormhole chain id configured at construction.
+    ///
+    /// Wormhole chain ids are 16-bit; `u32` is used here only because Soroban's
+    /// ABI has no 16-bit value type. The value is always in `0..=u16::MAX`.
     fn chain_id(env: Env) -> u32;
 
     /// Returns the version string of the Executor implementation.
     fn executor_version(env: Env) -> String;
 
     /// Records a prepaid cross-chain delivery request.
     ///
-    /// Validates the [`SignedQuote`], requires the payer's authorization,
-    /// transfers `amount` native tokens from `payer` to
-    /// `signed_quote.payee`, and emits a `RequestForExecution` event consumed
-    /// by off-chain relayers.
+    /// Parses the quote header from `signed_quote_bytes`, requires the payer's
+    /// authorization, transfers `amount` native tokens from `payer` to
+    /// `payee`, and emits a `RequestForExecution` event carrying the full
+    /// quote bytes for off-chain relayers.
     #[allow(clippy::too_many_arguments)]
     fn request_execution(
         env: Env,
         dst_chain: u32,
-        dst_addr_wa32: BytesN<32>,
+        dst_addr: BytesN<32>,
         refund: Address,
         payer: Address,
+        payee: Address,
         amount: i128,
-        signed_quote: SignedQuote,
+        signed_quote_bytes: Bytes,
         request: Bytes,
         relay_instructions: Bytes,
     ) -> Result<(), ExecutorError>;