No Cargo deny or audit configuration for dependency vulnerability scanning leaving supply chain unmonitored

[ALLEN-AYODEJI]

Description

There is no cargo-deny configuration or cargo-audit integration. Supply-chain vulnerabilities in crates.io dependencies (soroban-sdk, clap) are not detected until they are manually discovered. A compromised dependency in the crate graph could introduce malicious code into the compiled contract WASM or CLI binary.

Requirements and context

• Security: Standard security review required for state-mutating changes
• Testing: Full test suite must pass; new tests for changed behavior
• Documentation: Update doc comments and README if user-facing

Suggested execution

Branch: fix/fix/security-cargo-audit

Implement changes

• Install cargo-audit and cargo-deny as CI tools (not Rust dependencies)
• Create a deny.toml configuration at project root with: vulnerability database, license allowlist, duplicate version check
• Add a CI step that runs cargo deny check and cargo audit
• Fix any current advisories reported by cargo audit

Test and commit

Run cargo deny check and cargo audit. Fix or document any current advisories. Verify CI catches new advisories.

Example commit message

fix(security): add cargo-deny and cargo-audit for dependency vulnerability scanning

Guidelines

• Open a PR against master
• Keep PR focused on this single concern
• Run cargo test or npm test before review
• Ensure no lint or typecheck warnings