[Security] Submit allowlist includes the DeFindex factory, not just the vault

[collinsezedike]

Description

allowedContractIds in packages/stellar-sdk-helpers/src/tx.ts:304 adds addresses.defindex.factory to the set of contracts /tx/submit will accept invocations against, alongside addresses.defindex.vault on the next line. Factory contracts deploy other contracts; allowing arbitrary invocations of one re-opens part of the relay hole assertSubmittable exists to close (per its own docstring: "Guards /tx/submit against being used as an open relay for arbitrary Stellar transactions").

Confirmed via grep across packages/stellar-sdk-helpers/src: no real transaction-building code (defindex.ts, coordinator.ts) ever invokes the factory contract. It's allowlisted but never actually needed by any legitimate deposit/withdraw flow.

Steps to Reproduce

1. Read allowedContractIds in packages/stellar-sdk-helpers/src/tx.ts.
2. Note both addresses.defindex.factory and addresses.defindex.vault are added.
3. Confirm no call site in defindex.ts/coordinator.ts ever builds a transaction invoking the factory.

Expected Behavior

Only the specific DeFindex vault contract should be allowlisted; the factory should not be.

Actual Behavior

Both are allowlisted, widening what /tx/submit will relay beyond what any real Meridian flow needs.

Environment

Field	Value
Network	N/A
Wallet	N/A
Protocol affected	DeFindex
Browser (if frontend)	N/A
Node.js version	N/A
pnpm version	N/A

Possible Cause / Fix

Remove add(addresses.defindex.factory); from allowedContractIds in packages/stellar-sdk-helpers/src/tx.ts, keeping only add(addresses.defindex.vault);.

[abufauzahn]

Hi! I've carefully reviewed the entire task description and fully understand the requirements and expected outcome.
I have experience working on similar tasks and I'm confident I can complete this within about an hour. I'd be happy to take ownership of this issue and submit a clean, well-tested solution promptly.
If it's available, please assign it to me. Thank you!

[collinsezedike]

Go for it @yunus-dev-codecrafter

[grantfox-oss]

🦊 GrantFox — @yunus-dev-codecrafter has been assigned to this issue!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #482)
2. Your PR will be reviewed by the drydocs maintainers

Good luck! Track your progress on GrantFox.