ci(security): add cargo-deny policy, cargo-audit job, PR template, an…

.github/PULL_REQUEST_TEMPLATE.md

@@ -8,8 +8,13 @@ title: ''
 
 ## Test plan
 
+## Security & Dependencies
+- [ ] Any new or updated dependencies have been reviewed for supply-chain risk.
+
 ## Checklist
 
 - [ ] `cargo fmt --check` passes
 - [ ] `cargo clippy -D warnings` passes
 - [ ] `cargo test` passes
+- [ ] `cargo audit` passes
+- [ ] `cargo deny check` passes

.github/workflows/audit.yml

@@ -0,0 +1,50 @@
+name: Security & Dependency Audit
+
+on:
+  push:
+    branches:
+      - main
+      - develop
+  pull_request:
+    branches:
+      - main
+      - develop
+    types:
+      - opened
+      - synchronize
+      - reopened
+  schedule:
+    - cron: '0 0 * * 0'
+
+jobs:
+  audit:
+    name: Dependency Audit & Policy Check
+    runs-on: ubuntu-latest
+
+    defaults:
+      run:
+        working-directory: ./contracts
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Cache Cargo build artifacts
+        uses: Swatinem/rust-cache@v2
+        with:
+          cache-on-failure: true
+          workspaces: "./contracts"
+
+      - name: Install cargo-audit and cargo-deny
+        uses: taiki-e/install-action@v2
+        with:
+          tool: cargo-audit,cargo-deny
+
+      - name: Run cargo audit
+        run: cargo audit
+
+      - name: Run cargo deny check
+        run: cargo deny check

.github/workflows/ci.yml

@@ -6,6 +6,9 @@ on:
       - main
       - develop
   pull_request:
+    branches:
+      - main
+      - develop
     types:
       - opened
       - synchronize
@@ -15,7 +18,7 @@ jobs:
   ci:
     name: Rust CI
     runs-on: ubuntu-latest
-    
+
     defaults:
       run:
         working-directory: ./contracts
@@ -28,7 +31,7 @@ jobs:
         uses: dtolnay/rust-toolchain@stable
         with:
           components: rustfmt, clippy
-          targets: wasm32-unknown-unknown, wasm32v1-none
+          targets: wasm32-unknown-unknown
 
       - name: Cache cargo build artifacts
         uses: Swatinem/rust-cache@v2
@@ -37,7 +40,10 @@ jobs:
           workspaces: "./contracts"
 
       - name: Install Stellar CLI
-        uses: stellar/stellar-cli@v23.0.1
+        run: |
+          wget -q https://github.com/stellar/stellar-cli/releases/download/v23.0.1/stellar-cli-x86_64-unknown-linux-gnu.tar.gz
+          tar -xzf stellar-cli-x86_64-unknown-linux-gnu.tar.gz
+          sudo mv stellar /usr/local/bin/
 
       - name: Check formatting
         run: cargo fmt --all -- --check

Cargo.toml

@@ -11,6 +11,7 @@ resolver = "2"
 
 [workspace.dependencies]
 soroban-sdk = "23"
+ethnum = "1.5.3"
 
 [profile.release]
 overflow-checks = true

SECURITY.md

@@ -1,5 +1,18 @@
 # Security Policy
 
+## Reporting Vulnerabilities
+
+If you discover a potential security vulnerability within Orivex smart contracts or dependencies, please do NOT open a public issue.
+
+Report security vulnerabilities via private disclosure to the Orivex maintainers.
+
+## Dependency Security & CI Audits
+
+Orivex enforces automated supply-chain dependency audits in CI:
+- **`cargo-audit`**: Checks dependencies against the RustSec vulnerability database.
+- **`cargo-deny`**: Enforces license compliance, source integrity, and advisory bans.
+
+For detailed security policy and local audit execution steps, see [docs/security/audit.md](docs/security/audit.md).
 We take the security of this project seriously. This document outlines our vulnerability disclosure process, scope, and SLAs.
 
 ## Reporting a Vulnerability

contracts/Cargo.toml

@@ -11,6 +11,7 @@ resolver = "2"
 
 [workspace.dependencies]
 soroban-sdk = "23"
+ethnum = "1.5.3"
 
 [profile.release]
 overflow-checks = true

contracts/deny.toml

@@ -0,0 +1,37 @@
+[advisories]
+vulnerability = "deny"
+unmaintained = "transitive"
+notice = "warn"
+ignore = []
+
+[licenses]
+unlicensed = "deny"
+allow = [
+    "MIT",
+    "Apache-2.0",
+    "Unicode-3.0",
+    "Unicode-DFS-2016",
+    "BSD-2-Clause",
+    "BSD-3-Clause",
+    "ISC",
+    "CC0-1.0",
+    "Zlib",
+    "0BSD",
+    "WTFPL",
+    "MPL-2.0",
+]
+confidence-threshold = 0.8
+
+[bans]
+multiple-versions = "warn"
+wildcards = "allow"
+highlight = "all"
+deny = []
+skip = []
+skip-tree = []
+
+[sources]
+unknown-registry = "warn"
+unknown-git = "warn"
+allow-registry = ["https://github.com/rust-lang/crates.io-index"]
+allow-git = []

deny.toml

@@ -0,0 +1,37 @@
+[advisories]
+vulnerability = "deny"
+unmaintained = "transitive"
+notice = "warn"
+ignore = []
+
+[licenses]
+unlicensed = "deny"
+allow = [
+    "MIT",
+    "Apache-2.0",
+    "Unicode-3.0",
+    "Unicode-DFS-2016",
+    "BSD-2-Clause",
+    "BSD-3-Clause",
+    "ISC",
+    "CC0-1.0",
+    "Zlib",
+    "0BSD",
+    "WTFPL",
+    "MPL-2.0",
+]
+confidence-threshold = 0.8
+
+[bans]
+multiple-versions = "warn"
+wildcards = "allow"
+highlight = "all"
+deny = []
+skip = []
+skip-tree = []
+
+[sources]
+unknown-registry = "warn"
+unknown-git = "warn"
+allow-registry = ["https://github.com/rust-lang/crates.io-index"]
+allow-git = []

docs/security/audit.md

@@ -0,0 +1,47 @@
+# Dependency Security & Audit Policy
+
+## Overview
+
+Orivex smart contracts custody user funds and execute financial logic on the Soroban/Stellar network. Supply-chain security is critical to prevent vulnerabilities, malicious code injection, or unauthorized license usage across workspace dependencies.
+
+This document outlines the automated dependency security checks and policy enforced in CI.
+
+---
+
+## Tooling & Verification
+
+### 1. `cargo-audit`
+- **Purpose**: Scans `Cargo.lock` against the RustSec Advisory Database.
+- **Enforcement**: Any crate with an unmitigated vulnerability marked as `deny` will cause CI build failure.
+- **Local Execution**:
+  ```bash
+  cd contracts
+  cargo audit
+  ```
+
+### 2. `cargo-deny`
+- **Purpose**: Enforces license compliance, dependency bans, advisory checking, and crate source restrictions configured in `deny.toml`.
+- **Policy Configuration**: Defined in `deny.toml` at workspace root.
+  - **Advisories**: Vulnerabilities result in immediate build denial.
+  - **Licenses**: Allowlist restricted to permissive open-source licenses (`MIT`, `Apache-2.0`, `Unicode-3.0`, `BSD-2-Clause`, `BSD-3-Clause`, `ISC`, `CC0-1.0`, `Zlib`, `WTFPL`).
+  - **Bans**: Warns on duplicate crate versions; disallows unverified crate origins.
+- **Local Execution**:
+  ```bash
+  cd contracts
+  cargo deny check
+  ```
+
+---
+
+## Continuous Integration Trigger Schedule
+
+The security audit workflow (`.github/workflows/audit.yml`) executes under the following conditions:
+1. **Push**: Every push targeting `main` or `develop`.
+2. **Pull Requests**: Every open, synchronized, or reopened PR targeting `main` or `develop`.
+3. **Scheduled Scan**: Weekly automated cron job (`0 0 * * 0`) to catch newly disclosed vulnerabilities in existing dependencies.
+
+---
+
+## Advisory Waivers & Exception Process
+
+If an advisory warning is a false positive or does not impact contract safety (e.g. build-only tool dependency), temporary waivers must be explicitly recorded in `deny.toml` under `[advisories.ignore]` with a clear rationale, issue reference, and expiry plan.