Problem
While harvest_yield and emergency_pause use require_auth(), the test suite never explicitly verifies that an unauthorized actor calling these functions is successfully rejected by the environment.
Expected behavior
The test suite utilizes the env.mock_auths or expected panic attributes to simulate a random user calling admin/keeper functions, verifying the transaction reverts.
Files to update
Project relevance
Cryptographically guarantees the Vault's access control modifiers are functioning correctly, preventing malicious LPs from pausing the contract or spoofing yields.
Acceptance criteria
Problem
While
harvest_yieldandemergency_pauseuserequire_auth(), the test suite never explicitly verifies that an unauthorized actor calling these functions is successfully rejected by the environment.Expected behavior
The test suite utilizes the
env.mock_authsor expected panic attributes to simulate a random user calling admin/keeper functions, verifying the transaction reverts.Files to update
src/test.rsProject relevance
Cryptographically guarantees the Vault's access control modifiers are functioning correctly, preventing malicious LPs from pausing the contract or spoofing yields.
Acceptance criteria
Addressattempts to invokeemergency_pause