feat: implement secure remittance escrow with explicit auth verification (#718)

[Naajih09]

This PR implements a secure, cross-border remittance escrow contract. The
implementation focuses on Soroban's native authentication framework to ensure
that funds can only be moved or claimed by authorized participants, mitigating
the risk of unauthorized state manipulation.

Changes Made

• Authorization Verification:
  • Sender Verification: Implemented sender.require_auth() during escrow
    creation. This ensures the contract only transfers tokens if the
    transaction is signed by the legitimate owner of the funds.
  • Recipient Verification: Implemented recipient.require_auth() during the
    settlement phase. Funds can only be released if the intended recipient
    provides a valid signature.
• Contract Logic:
  • Created a RemittanceContract with an auto-incrementing ID system for
    tracking active escrows.
  • Used Persistent storage for escrow records to ensure data survives until
    the recipient claims the funds.
  • Implemented secure fund transfers using the soroban_sdk::token client.
• Event Emission:
  • EscrowCreated: Published when a sender initiates a transfer. Topics
    include (symbol_short!("created"), sender, recipient).
  • EscrowClaimed: Published upon successful fund release. Topics include
    (symbol_short!("claimed"), recipient).
• Storage Cleanup:
  • Implemented automatic storage removal (remove) after an escrow is
    claimed to optimize ledger space and reduce rent costs.

Technical Implementation Details

• Auth Pattern: Utilizes the standard Soroban require_auth pattern rather than
  checking env.invoker(), ensuring compatibility with smart wallet accounts
  and future-proofing the contract.
• Event Structure: Events follow a tiered topic structure for efficient
  off-chain indexing.

Acceptance Criteria Verification

• Enforced authorization checks on sender public key during escrow creation.
• Required recipient signature verification on escrow settlement and
  release.
• Emitted structured EscrowCreated and EscrowClaimed contract events.
• Added unit tests simulating authorized and unauthorized claim attempts.

Closes #718

[drips-wave]

@Naajih09 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits