fix(metadata): validate metadata size and encoding limits (#1382)

[s6pa1rta3n-lab]

Summary

Closes #1382

Implements deterministic metadata byte size validation and UTF-8 encoding verification for the Predictify Hybrid smart contract. Limits are enforced in raw UTF-8 bytes to eliminate multi-byte byte-inflation attacks on persistent ledger storage. Malformed encodings and control characters are rejected before state access or mutation.

Acceptance Criteria Checklist

• Limits are measured in bytes and documented.
  • Defined explicit byte limits in contracts/predictify-hybrid/src/metadata_limits.rs (MAX_QUESTION_BYTES = 500, MAX_OUTCOME_BYTES = 100, MIN_CATEGORY_BYTES = 2, MAX_CATEGORY_BYTES = 100, MIN_TAG_BYTES = 2, MAX_TAG_BYTES = 50, MAX_FEED_ID_BYTES = 200, MAX_COMPARISON_BYTES = 10, MAX_EXTENSION_REASON_BYTES = 300, MAX_SOURCE_BYTES = 100, MAX_ERROR_MESSAGE_BYTES = 200, MAX_SIGNATURE_BYTES = 500, MAX_DESCRIPTION_BYTES = 1000).
  • Updated contracts/predictify-hybrid/METADATA_LIMITS.md with complete byte limit specifications and threat model rationale.
• Malformed encoding is rejected before mutation.
  • scan_metadata_text validates UTF-8 decoding via core::str::from_utf8 and rejects invalid encodings and ASCII control codes (0x00..=0x1F) deterministically with Error::InvalidInput.
  • In contracts/predictify-hybrid/src/validation.rs, CreationValidator::soroban_string_to_host_string returns Result<StdString, Error> and fails with Error::InvalidInput on invalid UTF-8 bytes.
  • In contracts/predictify-hybrid/src/lib.rs, update_event_category checks validate_option_category_metadata prior to persistent storage retrieval and state mutation.
• Metadata updates preserve authorization and versioning.
  • Administrative endpoints (update_event_description, update_event_outcomes, update_event_category, update_event_tags) enforce Self::require_primary_admin(&env, &admin) authorization.
  • State mutations refresh cryptographic metadata commitments (market.refresh_metadata_commitment(&env)) to guarantee client cache invalidation.
• Boundary and fuzz tests pass.
  • Exact byte boundary tests verify acceptance at byte limits and rejection at limit + 1 byte for both ASCII and multi-byte UTF-8 sequences in contracts/predictify-hybrid/src/metadata_limits_tests.rs.
  • Property-based fuzz tests (proptest_fuzz::fuzz_validate_question_length and proptest_fuzz::fuzz_validate_category_and_tag) pass with 256 test cases each.

Security & Failure-Mode Considerations

• Byte-Inflation Defense: Measuring in UTF-8 bytes rather than Unicode scalar values eliminates the risk of 4x storage amplification from 4-byte glyphs.
• Fail-Fast Rejection: Text scanning immediately rejects embedded ASCII control characters and non-UTF-8 bytes before persisting data to ledger storage.
• Commitment Integrity: Metadata modifications update the market's metadata commitment hash, preventing desynchronization between off-chain indices and on-chain state.

Payout Routing

• EVM (Base/Arbitrum/Polygon/ETH): 0xF46C9F6d70C50BF81ef3588AB523a90a594a2F89
• Stellar: GCL6OXAMLD75BMTINA6EMRUDWK5THQUSHMYNLSNBCJAPZJHNYJTUNIBC