Recipient Deduplication Guard

[Kingsman-99]

Description

If the same Address appears more than once in the recipients list supplied at invoice creation, the contract silently assigns it multiple shares, resulting in double (or triple) payout to that address and a corresponding deficit for others. The contract must reject any initialize() call where the recipient list contains duplicate addresses before any storage is written.

Technical Context

contracts/split/src/lib.rs — initialize() entry point, which currently iterates recipients: Vec<RecipientShare> without uniqueness enforcement; contracts/split/src/validation.rs — add assert_unique_recipients(env: &Env, recipients: &[RecipientShare]) using a soroban_sdk::Map<Address, bool> for O(n log n) membership tracking; contracts/split/src/error.rs — add Error::DuplicateRecipient variant; the existing split_ratio_sum_validation logic in the same file serves as a structural reference for chaining validation guards.

Acceptance Criteria

• initialize() calls assert_unique_recipients() before writing any DataKey entry and returns Error::DuplicateRecipient on the first duplicate found
• The error code is distinct from all other Error variants and is documented in contracts/split/src/error.rs
• A test in contracts/split/src/tests/validation_tests.rs verifies that a recipient list with two identical addresses is rejected at the correct call site
• A test verifies that a list where all addresses are distinct passes the deduplication check and proceeds to storage write
• The check uses no unbounded heap allocation and completes in a single pass over the recipient slice
• All CI checks (cargo build --target wasm32-unknown-unknown, cargo test, cargo clippy) pass and the branch has no merge conflicts

---

[adeboladee]

@adeboladee has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Hello Maintainer, Please I would like to work on this issue

ℹ️ Repo Maintainers: To accept this application, review their application or assign @adeboladee to this issue.

[Carlys17]

@Carlys17 has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

I'd like to work on this. I'll add assert_unique_recipients using Address uniqueness checks in
contracts/split/src/validation.rs and a DuplicateRecipient error variant, rejecting initialize() with duplicate recipients.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Carlys17 to this issue.

[tegaReed-crypto]

@tegaReed-crypto has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Hi maintainer, I would love to work on this issue

ℹ️ Repo Maintainers: To accept this application, review their application or assign @tegaReed-crypto to this issue.

[drips-wave]

Congratulations, @tegaReed-crypto! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on July 30, 2026.

🧑‍💻 @tegaReed-crypto: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊