fix: low-severity defensive hardening (vault + factory)

* fix: defensive index removal and cap denied-issuer list

* fix: controlled error on missing VaultMeta instead of panic

* fix: clear freed index slot when tail is missing to avoid ghost entry

Author: aguilar1x

contracts/vc-vault-factory/src/errors.rs

@@ -18,4 +18,6 @@ pub enum FactoryError {
     FeeNotConfigured = 5,
     /// Custom fee expiry timestamp is not in the future.
     ExpiryInPast = 6,
+    /// VaultMeta is missing (constructor never ran or state lost).
+    NotInitialized = 7,
 }

contracts/vc-vault-factory/src/storage.rs

@@ -1,4 +1,6 @@
-use soroban_sdk::{contracttype, Address, BytesN, Env, Symbol};
+use soroban_sdk::{contracttype, panic_with_error, Address, BytesN, Env, Symbol};
+
+use crate::errors::FactoryError;
 
 const ONE_DAY_LEDGERS: u32 = 17_280; // ~5s per ledger
 
@@ -60,7 +62,7 @@ pub fn get_vault_init_meta(e: &Env) -> VaultInitMeta {
     e.storage()
         .instance()
         .get::<Symbol, VaultInitMeta>(&Symbol::new(e, "VaultMeta"))
-        .unwrap()
+        .unwrap_or_else(|| panic_with_error!(e, FactoryError::NotInitialized))
 }
 
 pub fn set_deployed(e: &Env, vault_address: &Address) {

contracts/vc-vault/src/constants.rs

@@ -49,3 +49,6 @@ pub const MAX_DID_URI_LEN: u32 = 256;
 pub const MAX_ISSUER_DID_LEN: u32 = 256;
 /// Maximum bytes for revocation `date` strings (ISO 8601).
 pub const MAX_DATE_LEN: u32 = 64;
+/// Maximum number of issuers a vault may hold in its denied (block) list.
+/// Bounds storage growth; the list only grows via admin `deny_issuer` calls.
+pub const MAX_DENIED_ISSUERS: u32 = 1_000;

contracts/vc-vault/src/storage/credential.rs

@@ -125,9 +125,17 @@ pub fn remove_vc_from_index(e: &Env, vc_id: &String) {
     }
     let last = count - 1;
     if position != last {
-        let last_id = read_vc_id_at(e, last).unwrap();
-        write_vc_id_at(e, position, &last_id);
-        write_vc_position(e, &last_id, position);
+        // Normal swap-and-pop moves the last entry into the freed slot.
+        // Defensive: if the last slot is somehow missing (corrupt state), clear
+        // the freed slot instead of leaving the removed id there — otherwise it
+        // becomes a ghost index entry. Never panic on the missing slot.
+        match read_vc_id_at(e, last) {
+            Some(last_id) => {
+                write_vc_id_at(e, position, &last_id);
+                write_vc_position(e, &last_id, position);
+            }
+            None => remove_vc_id_at(e, position),
+        }
     }
     remove_vc_id_at(e, last);
     remove_vc_position(e, vc_id);

contracts/vc-vault/src/storage/issuer.rs

@@ -1,8 +1,9 @@
 //! Denied issuer index storage. O(1) operations via swap-and-pop.
 
-use crate::constants::{PERSISTENT_TTL_EXTEND_TO, PERSISTENT_TTL_THRESHOLD};
+use crate::constants::{MAX_DENIED_ISSUERS, PERSISTENT_TTL_EXTEND_TO, PERSISTENT_TTL_THRESHOLD};
+use crate::error::ContractError;
 use super::VcVaultDataKey;
-use soroban_sdk::{Address, Env};
+use soroban_sdk::{panic_with_error, Address, Env};
 
 // --- Denied issuer index ---
 
@@ -84,6 +85,9 @@ pub fn append_denied_issuer_to_index(e: &Env, issuer: &Address) {
         return;
     }
     let count = read_denied_issuer_count(e);
+    if count >= MAX_DENIED_ISSUERS {
+        panic_with_error!(e, ContractError::IssuerListTooLong);
+    }
     write_denied_issuer_at(e, count, issuer);
     write_denied_issuer_position(e, issuer, count);
     write_denied_issuer_count(e, count + 1);
@@ -101,9 +105,17 @@ pub fn remove_denied_issuer_from_index(e: &Env, issuer: &Address) {
     }
     let last = count - 1;
     if position != last {
-        let last_addr = read_denied_issuer_at(e, last).unwrap();
-        write_denied_issuer_at(e, position, &last_addr);
-        write_denied_issuer_position(e, &last_addr, position);
+        // Normal swap-and-pop moves the last entry into the freed slot.
+        // Defensive: if the last slot is somehow missing (corrupt state), clear
+        // the freed slot instead of leaving the removed issuer there — otherwise
+        // it becomes a ghost index entry. Never panic on the missing slot.
+        match read_denied_issuer_at(e, last) {
+            Some(last_addr) => {
+                write_denied_issuer_at(e, position, &last_addr);
+                write_denied_issuer_position(e, &last_addr, position);
+            }
+            None => remove_denied_issuer_at(e, position),
+        }
     }
     remove_denied_issuer_at(e, last);
     remove_denied_issuer_position(e, issuer);