Contract Deployment Initialiser Guard

[Kingsman-99]

Description

The init function can currently be called multiple times, allowing an attacker who front-runs the deployer to hijack the contract by setting their own admin. A one-shot initialiser guard must ensure init can only execute once across the contract's lifetime.

Technical Context

Add an Initialised boolean to storage::instance in contracts/split/src/lib.rs. At the top of init, call env.storage().instance().get::<_, bool>(&DataKey::Initialised) and panic with AlreadyInitialised (new variant in types.rs) if it is set. Set the flag atomically at the end of init.

Acceptance Criteria

• A second call to init returns AlreadyInitialised error
• The flag is written inside the same transaction as the rest of init setup
• Deployment integration test verifies the guard works in a fresh environment
• The flag persists across ledgers via storage::instance
• No admin-settable bypass exists for the guard
• All CI checks (cargo build --target wasm32-unknown-unknown, cargo test, cargo clippy) pass and the branch has no merge conflicts

---

[oderindesuliha]

@oderindesuliha has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Hi Maintainer, I’ve reviewed the issue and I’m confident I can deliver a clean, well tested solution. I’d appreciate the opportunity to work on it.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @oderindesuliha to this issue.

[sam-boyega]

@sam-boyega has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Familiar with such issue where the init function can be called repeatedly letting an attacker front-run the deployer and seize admin control. Let me fix this please.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @sam-boyega to this issue.

[k2ghostyou]

@k2ghostyou has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

i would love to work on this issue and summit pr withing 1 day

ℹ️ Repo Maintainers: To accept this application, review their application or assign @k2ghostyou to this issue.

[drips-wave]

Congratulations, @k2ghostyou! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on July 30, 2026.

🧑‍💻 @k2ghostyou: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊

[grantfox-oss]

🎉 This issue has been marked as completed on GrantFox as part of the Official Campaign | FWC26 campaign!

@k2ghostyou's PR #550 was approved and merged by @Kingsman-99.

🏆 @k2ghostyou: You earned 35 FoxPoints for this contribution! Your current tier: Explorer (153 total points). Track your full progress on GrantFox.

👏 Great work, @k2ghostyou! Keep contributing to Stellar-split.

[drips-wave]

This issue has been completed by @k2ghostyou as part of the Stellar Wave Program's 7th Wave 🥳

😎 @k2ghostyou: You earned 200 Points for completing this issue! After the current Wave ends, you'll be eligible for a percentage of the Wave's reward pool based on the percentage of total points you've earned. Learn more here. You can also Leave a review to share your experience working on this issue.

🧑‍💻 Repo maintainers: How'd the contributor do? Leave a review to share your experience working with them.