[oracle-verifier] OracleList in instance storage retains soft-deleted oracle addresses — grows without bound

[nonsobethel0-dev]

Summary

contracts/oracle-verifier/src/lib.rs maintains a Vec<Address> at StorageKey::OracleList in instance storage. add_oracle appends to this list (lines 99–105). remove_oracle sets entry.active = false in the oracle's persistent entry but never removes the address from OracleList (lines 109–119).

Code

// add_oracle (lines 99-105): appends
let mut list: Vec<Address> = env.storage().instance()
    .get(&StorageKey::OracleList).unwrap_or_else(|| Vec::new(&env));
list.push_back(oracle);
env.storage().instance().set(&StorageKey::OracleList, &list);

// remove_oracle (lines 109-119): does NOT touch OracleList
pub fn remove_oracle(env: Env, admin: Address, oracle: Address, data_type: Symbol) {
    Self::require_admin(&env, &admin);
    let key = StorageKey::Oracle(data_type.clone(), oracle.clone());
    let mut entry: OracleEntry = env.storage().persistent().get(&key)...;
    entry.active = false;
    env.storage().persistent().set(&key, &entry);
    // ← OracleList unchanged
}

Impact

• get_oracles() returns deactivated oracle addresses — callers get a misleading view of the active oracle set
• Instance storage has a per-entry byte cap; with many oracle rotations the list will overflow
• Any off-chain monitoring or governance tooling that calls get_oracles to enumerate active participants will see ghost addresses

Fix

In remove_oracle, filter the deactivated address out of OracleList:

let list: Vec<Address> = env.storage().instance().get(&StorageKey::OracleList)...;
let mut pruned: Vec<Address> = Vec::new(&env);
for addr in list.iter() {
    if addr != oracle { pruned.push_back(addr); }
}
env.storage().instance().set(&StorageKey::OracleList, &pruned);

Severity: Medium

[directorfloo]

@directorfloo has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

I would love to work on this issue expertly, please assign it to me

ℹ️ Repo Maintainers: To accept this application, review their application or assign @directorfloo to this issue.

[amiramusa187-glitch]

@amiramusa187-glitch has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Hi, can I work on this please?

ℹ️ Repo Maintainers: To accept this application, review their application or assign @amiramusa187-glitch to this issue.

[prissca]

@prissca has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

i will love to work on this issue

ℹ️ Repo Maintainers: To accept this application, review their application or assign @prissca to this issue.

[drips-wave]

Congratulations, @prissca! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on July 30, 2026.

🧑‍💻 @prissca: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊

[drips-wave]

This issue has been completed by @prissca as part of the Stellar Wave Program's 7th Wave 🥳

😎 @prissca: You earned 200 Points for completing this issue! After the current Wave ends, you'll be eligible for a percentage of the Wave's reward pool based on the percentage of total points you've earned. Learn more here. You can also Leave a review to share your experience working on this issue.

🧑‍💻 Repo maintainers: How'd the contributor do? Leave a review to share your experience working with them.