[hpmaxi]

Summary

Closes #419

14 bare is_err() refusals added since #397 now assert the exact error: the contract's own error, the specific access-control error, or the host's own missing-signature error through the existing missing_auth helper.

Changes

• cancel.rs: a deploy above the free reserve now asserts ReserveCommittedToExits.
• compliance.rs: a share transfer by a delisted holder asserts IdentityVerificationFailed; by a frozen holder asserts AddressFrozen.
• deposit_cap.rs: set_deposit_cap signed by the wrong account asserts the missing-signature error.
• events.rs: request_deposit of 0 asserts InvalidAmount.
• notice.rs: set_notice with no signature asserts the missing-signature error.
• sealing.rs: set_min_epoch_duration with no signature, and close_epoch by an outsider, both assert the missing-signature error.
• settlement.rs: a claim refused by a compliance module that refuses every mint asserts MintNotCompliant.
• setup.rs: accept_admin_transfer after a cancelled hand-over asserts NoPendingTransfer; finish_setup signed by the wrong account asserts the missing-signature error.
• identity-verifier/test.rs: allow signed by a stranger asserts the missing-signature error (both directions); verify_identity for an unallowed account asserts IdentityVerificationFailed. Added a small missing_auth helper, matching the one the vault's and the other contracts' test suites already have.

Test plan

Automated tests

1. cargo test --locked -p async-vault -p identity-verifier -p compliance -p nav-oracle -p share-token — 526 (async-vault), 7 (identity-verifier), 42 (compliance), 111 (nav-oracle), 114 (share-token) passed, 0 failed, unchanged from before the rewrite.
2. cargo test --locked (full workspace) — all green.
3. cargo clippy --workspace --all-targets --locked -- -D warnings — clean.
4. cargo fmt --all -- --check — clean.
5. git grep 'is_err())' -- 'contracts/**/test*.rs' 'contracts/**/test/*.rs' — no matches.
6. Two deliberate breaks, each reverted after confirming the exact assertion (not a bare is_err()) caught it:
   • Swapped ReserveCommittedToExits for InvalidAmount in the free-reserve guard — test::cancel::refundable_escrow_is_not_free_reserve failed on the wrong error code.
   • Swapped IdentityVerificationFailed for AddressFrozen in the identity-verifier stub — test::verify_identity_checks_allowlist failed on the wrong error code.

Manual verification

None needed; this is a test-only change.

Breaking changes

None.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
strata-vault-kit-app	Ready	Preview	Nov 2, 2026 3:59pm UTC