Consider adding extension whitelist + community registry

[Rapha-btc]

Extensions are shared — one extension contract, many wallets call it.

┌─────────────────┐
│  Wallet A       │───┐
└─────────────────┘   │
                      │    ┌──────────────────────────┐
┌─────────────────┐   ├───▶│  ext-sponsored-transfer  │
│  Wallet B       │───┤    └──────────────────────────┘
└─────────────────┘   │
                      │    ┌──────────────────────────┐
┌─────────────────┐   ├───▶│  ext-delegate-stx        │
│  Wallet C       │───┘    └──────────────────────────┘
└─────────────────┘

So the registry makes even more sense — validate once, everyone benefits.

Title: Consider adding extension whitelist + community registry

Description:

Currently any contract implementing extension-trait can be called via extension-call if an admin chooses to call it. The trust model relies entirely on the admin not calling malicious extensions. This is very dangerous.

Proposal 1: Per-wallet whitelist

(define-map wallet-extensions principal bool)

(define-public (set-extension (extension principal) (enabled bool))
  (begin
    (try! (is-authorized))
    (ok (map-set wallet-extensions extension enabled))
  )
)

Proposal 2: Global extension registry with defaults

Since extensions are shared contracts (one extension, many wallets), we could have a global registry:

;; extension-registry.clar

(define-map approved-extensions
  (buff 32)  ;; contract-hash of extension template
  {
    approved: bool,
    registered-by: principal,
    endorsement-count: uint,
    registered-at: uint
  }
)

(define-map user-endorsements
  { user: principal, extension-hash: (buff 32) }
  bool
)

(define-read-only (is-approved-extension (extension principal))
  (match (map-get? approved-extensions (contract-hash? extension))
    data (get approved data)
    false
  )
)

Default approved extensions (shipped with CSW):

• ext-sponsored-transfer
• ext-sponsored-send-many
• ext-sponsored-sbtc-transfer
• ext-delegate-stx-pox-4

Proposal 3: Require BOTH global approval AND per-wallet whitelist

A wallet can only whitelist from globally approved extensions. Double consent = safer.

(asserts! 
  (and 
    (contract-call? .extension-registry is-approved-extension (contract-of extension))
    (is-wallet-whitelisted (contract-of extension))
  )
  err-extension-not-approved
)

Flow:

1. Extension gets audited → added to global registry
2. User sees extension is trusted by community (endorsement count)
3. User whitelists it for their wallet
4. Now they can use it

No shortcut — can't call unaudited extensions, can't call extensions you didn't explicitly approve.

Benefits:

• Default safe — only pre-approved extensions available
• Hash validation — ensures exact code, not a modified copy
• Community trust — endorsement count as social signal
• Per-wallet consent — user must explicitly opt-in
• One audit benefits all — shared extensions = shared security

Tradeoff:

• Who approves defaults? (Governance question)
• Extra tx to whitelist before first use
• Doesn't guarantee safety (approved ≠ bug-free)

Worth considering for CSW?

---

Ready to post on https://github.com/polimartlabs/csw-locker-contracts/issues

[friedger]

Not sure whether this should be part of on-chain. We can go down the rabbit hole of calling trusted contracts in general.