[Contracts] property_registry allows permanent property_id squatting with no recovery

[david87131]

Why this matters

register_property only calls landlord.require_auth where landlord is an arbitrary caller-supplied address, and property_id is globally unique with no update, remove, or admin-recovery function. An attacker can pre-register the ids a real landlord will need and permanently grief the namespace. There is also no way to revoke a verification or correct a fraudulent record, and no admin transfer if the admin key is lost.

Acceptance criteria

• There is an admin or escalation path to remove/reassign a squatted or fraudulent property_id
• Verification can be revoked by the admin if a property is later found invalid
• An admin transfer function exists so a lost/compromised admin key is recoverable
• Tests cover removal/reassignment of a property and verification revocation

Files to touch

• contracts/property_registry/src/property.rs
• contracts/property_registry/src/lib.rs

Out of scope

• Linking properties to the agreement lifecycle
• Off-chain metadata pinning

[david87131]

Superseded by the consolidated contract audit issues (#67-#104) which cover the same findings more comprehensively. Closing to avoid duplicate coverage.

[Mystery-CLI]

I have read through the required implementations and understand what to do can i work on it?

[Mystery-CLI]

I have read through the required implementations and understand what to do can i work on it?