feat: reject timestamp=0 in submit_score and submit_scores_batch

- Add InvalidTimestamp = 25 to errors.rs
- Guard submit_score: return InvalidTimestamp when timestamp == 0
- Guard submit_scores_batch: skip entries with timestamp == 0
- Update submit_score rustdoc to document non-zero timestamp requirement
- Add test_submit_score_zero_timestamp_rejected
- Add test_batch_skips_zero_timestamp_entries
- Add test_submit_score_nonzero_timestamp_accepted
- Fix test_set_service_rotates_authorised_account (timestamp 0 → 1)
- Add Error Codes table to README.md

Author: Mmesolove

README.md

@@ -174,6 +174,36 @@ A wallet scoring 60-70 on three pairs individually might not breach the per-pair
 
 `get_aggregate_score` iterates the wallet's full pair list, so its cost is O(N) in the number of distinct pairs the wallet has scores for. The contract is designed around a practical maximum of `MAX_WALLET_PAIRS` (20) pairs per wallet; this is documented as a constant but not enforced on-chain.
 
+## Error Codes
+
+| Code | Name | When returned |
+|------|------|---------------|
+| 1 | `AlreadyInitialized` | `initialize` called more than once |
+| 2 | `NotInitialized` | Any state-mutating call before `initialize` |
+| 3 | `Unauthorized` | Caller is not the authorised service or admin |
+| 4 | `InvalidScore` | `score` outside 0-100 |
+| 5 | `InvalidConfidence` | `confidence` outside 0-100 |
+| 6 | `ScoreNotFound` | `get_score` / `get_aggregate_score` for an unknown pair |
+| 7 | `ContractPaused` | Submission attempted while admin circuit-breaker is active |
+| 8 | `NoPendingAdminTransfer` | `accept_admin` / `cancel_admin_transfer` with no transfer in flight |
+| 9 | `EmptyBatch` | `submit_scores_batch` called with zero entries |
+| 10 | `BatchTooLarge` | Batch exceeds `MAX_BATCH_SIZE` (20) |
+| 11 | `ArithmeticOverflow` | Weighted aggregate computation overflows |
+| 12 | `UpgradeAlreadyPending` | `propose_upgrade` while a proposal is already pending |
+| 13 | `NoPendingUpgrade` | `execute_upgrade` / `veto_upgrade` / `get_pending_upgrade` with no proposal |
+| 14 | `InsufficientSigners` | Fewer than threshold signers supplied to `submit_score` |
+| 15 | `UnauthorizedSigner` | A supplied signer is not in the service set |
+| 16 | `InvalidThreshold` | `set_service_threshold` given `0` or a value > set size |
+| 17 | `ServiceSetFull` | `add_service_signer` when set already has `MAX_SERVICE_SIGNERS` members |
+| 18 | `SignerAlreadyInSet` | `add_service_signer` with an address already present |
+| 19 | `SignerNotInSet` | `remove_service_signer` with an address not in the set |
+| 20 | `UpgradeNotReady` | `execute_upgrade` before the time-lock has elapsed |
+| 21 | `InvalidUpgradeDelay` | `set_upgrade_delay` value outside `[MIN, MAX]` bounds |
+| 22 | `InvalidStalenessWindow` | `set_staleness_window` called with `0` |
+| 23 | `RateLimitExceeded` | Submission before the per-pair cooldown has elapsed |
+| 24 | `InvalidCooldown` | `set_cooldown` value outside `[MIN_COOLDOWN_SECS, MAX_COOLDOWN_SECS]` |
+| 25 | `InvalidTimestamp` | `submit_score` called with `timestamp = 0` |
+
 ## Upgrade Governance
 
 Soroban contracts can be upgraded by the admin via `update_current_contract_wasm`, which replaces the **entire** contract logic in a single transaction. Without governance, one admin key — or a compromised one — could silently install a backdoor or disable a security check with no warning. LedgerLens gates every upgrade behind an on-chain **time-lock** so the community always gets a mandatory window to inspect and react.

contracts/ledgerlens-score/src/errors.rs

@@ -59,4 +59,6 @@ pub enum Error {
     /// Returned when `set_cooldown` is given a value below
     /// `MIN_COOLDOWN_SECS` or above `MAX_COOLDOWN_SECS`.
     InvalidCooldown = 24,
+    /// Returned when the submitted timestamp is zero.
+    InvalidTimestamp = 25,
 }

contracts/ledgerlens-score/src/lib.rs

@@ -108,6 +108,8 @@ impl LedgerLensScoreContract {
     /// elapsed since the last accepted one, returning `RateLimitExceeded`.
     /// See the README's Rate Limiting section.
     ///
+    /// `timestamp` must be non-zero; `0` is rejected with `InvalidTimestamp`.
+    ///
     /// # Examples
     ///
     /// ```
@@ -176,6 +178,9 @@ impl LedgerLensScoreContract {
         if confidence > 100 {
             return Err(Error::InvalidConfidence);
         }
+        if timestamp == 0 {
+            return Err(Error::InvalidTimestamp);
+        }
 
         let last_submit = storage::get_last_submit_time(&env, &wallet, &asset_pair);
         let cooldown = storage::get_cooldown_secs(&env);
@@ -263,7 +268,7 @@ impl LedgerLensScoreContract {
         for i in 0..submissions.len() {
             let sub = submissions.get(i).unwrap();
 
-            if sub.score > 100 || sub.confidence > 100 {
+            if sub.score > 100 || sub.confidence > 100 || sub.timestamp == 0 {
                 continue;
             }
 

contracts/ledgerlens-score/src/test.rs

@@ -181,7 +181,7 @@ fn test_set_service_rotates_authorised_account() {
 
     let wallet = Address::generate(&env);
     let asset_pair = symbol_short!("XLM_USDC");
-    client.submit_score(&Vec::new(&env), &wallet, &asset_pair, &10, &false, &false, &0, &10, &1);
+    client.submit_score(&Vec::new(&env), &wallet, &asset_pair, &10, &false, &false, &1, &10, &1);
 }
 
 // ── Pause circuit breaker ─────────────────────────────────────────────────────
@@ -1215,3 +1215,71 @@ fn test_set_staleness_window_updates_stale_check() {
     env.ledger().with_mut(|l| l.timestamp = ts + 11);
     assert!(client.is_score_stale(&wallet, &pair));
 }
+
+// ── Timestamp validation ──────────────────────────────────────────────────────
+
+#[test]
+fn test_submit_score_zero_timestamp_rejected() {
+    let (env, client, _admin, _service) = initialized();
+    let wallet = Address::generate(&env);
+    let asset_pair = symbol_short!("XLM_USDC");
+    let result = client.try_submit_score(
+        &Vec::new(&env),
+        &wallet,
+        &asset_pair,
+        &50,
+        &false,
+        &false,
+        &0,
+        &80,
+        &1,
+    );
+    assert_eq!(result, Err(Ok(Error::InvalidTimestamp)));
+}
+
+#[test]
+fn test_batch_skips_zero_timestamp_entries() {
+    let (env, client, _admin, _service) = initialized();
+    let wallet_zero = Address::generate(&env);
+    let wallet_ok = Address::generate(&env);
+    let asset_pair = symbol_short!("XLM_USDC");
+
+    let mut batch: Vec<ScoreSubmission> = Vec::new(&env);
+    batch.push_back(ScoreSubmission {
+        wallet: wallet_zero.clone(),
+        asset_pair: asset_pair.clone(),
+        score: 50,
+        benford_flag: false,
+        ml_flag: false,
+        timestamp: 0,
+        confidence: 80,
+        model_version: 1,
+    });
+    batch.push_back(ScoreSubmission {
+        wallet: wallet_ok.clone(),
+        asset_pair: asset_pair.clone(),
+        score: 60,
+        benford_flag: false,
+        ml_flag: false,
+        timestamp: 1,
+        confidence: 75,
+        model_version: 1,
+    });
+
+    let accepted = client.submit_scores_batch(&batch);
+    assert_eq!(accepted, 1);
+    assert_eq!(client.get_score(&wallet_ok, &asset_pair).score, 60);
+    assert_eq!(
+        client.try_get_score(&wallet_zero, &asset_pair),
+        Err(Ok(Error::ScoreNotFound))
+    );
+}
+
+#[test]
+fn test_submit_score_nonzero_timestamp_accepted() {
+    let (env, client, _admin, _service) = initialized();
+    let wallet = Address::generate(&env);
+    let asset_pair = symbol_short!("XLM_USDC");
+    client.submit_score(&Vec::new(&env), &wallet, &asset_pair, &50, &false, &false, &1, &80, &1);
+    assert_eq!(client.get_score(&wallet, &asset_pair).score, 50);
+}