test: require_auth coverage sweep across contracts

- Audited all privileged entrypoints in vault, revenue_pool, and settlement
- Added negative require_auth tests to each crate's test.rs
- Fixed pre-existing setup_contract missing third_party in settlement tests
- Documented intentional exceptions: settlement::init and vault::require_owner
- Updated SECURITY.md with audit findings and cross-references
- All 180 tests pass

Closes #160

Author: Sam-Rytech

contracts/revenue_pool/src/test.rs

@@ -328,3 +328,83 @@ fn require_auth_receive_payment_fails_without_auth() {
     let result = client.try_receive_payment(&attacker, &100, &false);
     assert!(result.is_err(), "receive_payment must require auth");
 }
+
+#[test]
+fn set_admin_non_admin_caller_panics() {
+    let env = Env::default();
+    env.mock_all_auths();
+    let admin = Address::generate(&env);
+    let attacker = Address::generate(&env);
+    let new_admin = Address::generate(&env);
+    let (_, client) = create_pool(&env);
+    let (usdc, _, _) = create_usdc(&env, &admin);
+    client.init(&admin, &usdc);
+    let result = client.try_set_admin(&attacker, &new_admin);
+    assert!(result.is_err(), "non-admin cannot call set_admin");
+}
+#[test]
+fn claim_admin_wrong_pending_panics() {
+    let env = Env::default();
+    env.mock_all_auths();
+    let admin = Address::generate(&env);
+    let new_admin = Address::generate(&env);
+    let attacker = Address::generate(&env);
+    let (_, client) = create_pool(&env);
+    let (usdc, _, _) = create_usdc(&env, &admin);
+    client.init(&admin, &usdc);
+    client.set_admin(&admin, &new_admin);
+    let result = client.try_claim_admin(&attacker);
+    assert!(result.is_err(), "wrong pending admin cannot claim");
+}
+#[test]
+fn receive_payment_emits_event() {
+    let env = Env::default();
+    env.mock_all_auths();
+    let admin = Address::generate(&env);
+    let (pool_addr, client) = create_pool(&env);
+    let (usdc, _, usdc_admin) = create_usdc(&env, &admin);
+    client.init(&admin, &usdc);
+    fund_pool(&usdc_admin, &pool_addr, 500);
+    client.receive_payment(&admin, &100, &true);
+    let events = env.events().all();
+    assert!(events.len() >= 1);
+}
+#[test]
+fn distribute_self_recipient_panics() {
+    let env = Env::default();
+    env.mock_all_auths();
+    let admin = Address::generate(&env);
+    let (pool_addr, client) = create_pool(&env);
+    let (usdc, _, usdc_admin) = create_usdc(&env, &admin);
+    client.init(&admin, &usdc);
+    fund_pool(&usdc_admin, &pool_addr, 500);
+    let result = client.try_distribute(&admin, &pool_addr, &100);
+    assert!(result.is_err(), "cannot distribute to contract itself");
+}
+#[test]
+fn distribute_non_admin_panics() {
+    let env = Env::default();
+    env.mock_all_auths();
+    let admin = Address::generate(&env);
+    let attacker = Address::generate(&env);
+    let recipient = Address::generate(&env);
+    let (pool_addr, client) = create_pool(&env);
+    let (usdc, _, usdc_admin) = create_usdc(&env, &admin);
+    client.init(&admin, &usdc);
+    fund_pool(&usdc_admin, &pool_addr, 500);
+    let result = client.try_distribute(&attacker, &recipient, &100);
+    assert!(result.is_err(), "non-admin cannot distribute");
+}
+#[test]
+fn distribute_zero_amount_panics() {
+    let env = Env::default();
+    env.mock_all_auths();
+    let admin = Address::generate(&env);
+    let recipient = Address::generate(&env);
+    let (pool_addr, client) = create_pool(&env);
+    let (usdc, _, usdc_admin) = create_usdc(&env, &admin);
+    client.init(&admin, &usdc);
+    fund_pool(&usdc_admin, &pool_addr, 500);
+    let result = client.try_distribute(&admin, &recipient, &0);
+    assert!(result.is_err(), "zero amount distribute must fail");
+}

contracts/vault/src/lib.rs

@@ -325,7 +325,10 @@ impl CalloraVault {
         if let Some(s) = inst.get::<StorageKey, Address>(&StorageKey::Settlement) {
             let ut: Address = inst.get(&StorageKey::UsdcToken).unwrap();
             Self::transfer_funds(&env, &ut, &s, amount);
-        } else if inst.get::<StorageKey, Address>(&StorageKey::RevenuePool).is_some() {
+        } else if inst
+            .get::<StorageKey, Address>(&StorageKey::RevenuePool)
+            .is_some()
+        {
             Self::transfer_to_revenue_pool(env.clone(), amount);
         }
         let rid = request_id.unwrap_or(Symbol::new(&env, ""));
@@ -372,7 +375,10 @@ impl CalloraVault {
         if let Some(s) = inst.get::<StorageKey, Address>(&StorageKey::Settlement) {
             let ut: Address = inst.get(&StorageKey::UsdcToken).unwrap();
             Self::transfer_funds(&env, &ut, &s, total);
-        } else if inst.get::<StorageKey, Address>(&StorageKey::RevenuePool).is_some() {
+        } else if inst
+            .get::<StorageKey, Address>(&StorageKey::RevenuePool)
+            .is_some()
+        {
             Self::transfer_to_revenue_pool(env.clone(), total);
         }
         meta.balance