Summary
contracts/policy-engine/src/lib.rs stores all product IDs in a Vec<u128> at StorageKey::ActiveProducts in instance storage. create_product appends to this Vec (line 134). pause_product and deprecate_product only update the product's status in persistent storage — they never remove the product ID from ActiveProducts.
Code
// create_product (line 133-136) — appends
let mut products: Vec<u128> = env.storage().instance()
.get(&StorageKey::ActiveProducts).unwrap_or_else(|| Vec::new(&env));
products.push_back(id);
env.storage().instance().set(&StorageKey::ActiveProducts, &products);
// pause_product (line 140-144) — does NOT remove from ActiveProducts
pub fn pause_product(env: Env, admin: Address, product_id: u128) {
Self::require_admin(&env, &admin);
let mut product: InsuranceProduct = Self::load_product(&env, product_id);
product.status = ProductStatus::Paused;
env.storage().persistent().set(&StorageKey::Product(product_id), &product);
// ← product_id stays in ActiveProducts
}Impact
get_active_products() returns deprecated and paused product IDs alongside truly active ones — callers must re-load each product to filter- Instance storage has a per-entry size limit (~2KB). At 16 bytes per u128, the cap is hit at ~125 products — a realistic long-term threshold for an insurance platform
- Once the size limit is hit, all subsequent
create_product calls will panic
Fix
Remove the product ID from ActiveProducts in both pause_product and deprecate_product. Alternatively, name the storage key AllProducts to accurately represent its contents.
Severity: High
Summary
contracts/policy-engine/src/lib.rsstores all product IDs in aVec<u128>atStorageKey::ActiveProductsin instance storage.create_productappends to this Vec (line 134).pause_productanddeprecate_productonly update the product's status in persistent storage — they never remove the product ID fromActiveProducts.Code
Impact
get_active_products()returns deprecated and paused product IDs alongside truly active ones — callers must re-load each product to filtercreate_productcalls will panicFix
Remove the product ID from
ActiveProductsin bothpause_productanddeprecate_product. Alternatively, name the storage keyAllProductsto accurately represent its contents.Severity: High