Verify sdk 23→27 storage decode compatibility before mainnet protocol-27 upgrade

[0xdevcollins]

Severity: HIGH · Contract · boundless-events + boundless-profile · blocks mainnet protocol-27 upgrade

Context

The network (mainnet + testnet) is on Protocol 27. PR #87 bumps soroban-sdk 23.5.2 → 27.0.0 (Rust 1.93, stellar-cli 27.0.0) so the contract is built against the current protocol. That PR is safe to merge to testnet, but a mainnet upgrade to the sdk-27 wasm carries a decode-compatibility risk that must be verified first.

Problem

Mainnet is live at 1.1.0, compiled with soroban-sdk 23.x, and holds real state (EventRecord, Winner, Submission, contributor rows, etc.). If we apply_upgrade to an sdk-27 wasm, every persisted row must still decode through the new SDK. A change in how any persisted type serializes across the SDK boundary would trap on read (Error(Object, UnexpectedSize)) — the same failure class that sank #83, but across an SDK version rather than a struct change.

The host test suite starts from empty state, so it does not exercise cross-version decode. Green tests are not evidence here.

Acceptance

• A test (or testnet exercise) that writes rows in the sdk-23 layout and reads them back through sdk-27 code for every persisted type: EventRecord, Winner, Submission, contributor amount/index, cancellation state, the 1.3.0 prize keys, and instance/config keys.
• OR: deploy sdk-23 (1.1.0-equivalent), seed representative rows on testnet, apply_upgrade to the sdk-27 wasm via the H6 timelocked path, and confirm every read path (get_event, get_winners, claim_*, start_cancel scans) works post-upgrade.
• Documented result in the mainnet-deploy runbook before the mainnet propose_upgrade.

Notes

• Non-blocking for merging chore: bump soroban-sdk to 27.0.0 and close out scanner noise #87 to testnet. This gates the mainnet step only.
• Related: Chore: confirm soroban-sdk is latest; close out storage_change_events scanner noise #77 (SDK bump), chore: bump soroban-sdk to 27.0.0 and close out scanner noise #87 (PR), Enhanced Milestone & Admin Management Functions for On-chain/Frontend Sync #3 (upgrade path).

[coderabbitai]

🔗 Related PRs

#59 - docs: rewrite README with deployed addresses and versions [merged]
#60 - Revise README and CI workflows for 1.1.0 deployment update [merged]
#78 - test(admin): assert admin auth is actually required, not just mocked [merged]
#87 - chore: bump soroban-sdk to 27.0.0 and close out scanner noise [open]
#90 - feat(events): pull-model prize claims for Single-release events [open]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[0xdevcollins]

This is not for External contributors @comzzy-comzzy @Ebenezer199914

[OluRemiFour]

I've reviewed the issue and understand the requirements. I'd love to work on this and submit a clean PR that meets the acceptance criteria.

[Glam26]

Hi! I'd like to take this on.

I'll start by reviewing the current implementation to understand how this feature fits into the existing codebase, then implement the requested changes in a way that's consistent with the project's architecture and conventions.

My goal is to:

• Implement all requirements outlined in the issue.
• Keep the solution clean, maintainable, and minimally invasive.
• Add or update tests covering the new behavior, including edge cases where appropriate.
• Verify that the implementation satisfies the acceptance criteria and doesn't introduce regressions.

I'll share a PR with a clear summary of the changes, testing performed, and any design decisions made during implementation.

[Glam26]

Hi! I'd like to take this on.

I'll start by reviewing the current implementation to understand how this feature fits into the existing codebase, then implement the requested changes in a way that's consistent with the project's architecture and conventions.

My goal is to:

• Implement all requirements outlined in the issue.
• Keep the solution clean, maintainable, and minimally invasive.
• Add or update tests covering the new behavior, including edge cases where appropriate.
• Verify that the implementation satisfies the acceptance criteria and doesn't introduce regressions.

I'll share a PR with a clear summary of the changes, testing performed, and any design decisions made during implementation.

[ekwe7]

I would love to work on this issue. I have experience building production ready applications and collaborating through GitHub workflows. I'll carefully analyze the current implementation, propose a reliable solution, and submit a well-tested PR. My focus is on clean code, maintainability, and timely delivery

[jaynomyaro]

Hi! I’m a full-stack developer with a strong blockchain background. I’d love to handle this issue and can deliver a clean, reliable solution. Kindly assign it to me.