[PeerX Backlog # 39] `MintToken` batch path must require authentication

[ameeribro4-sudo]

Problem Statement
lib.rs::execute_batch_atomic calls
crate::require_verified_user(env, caller_addr) only when caller is
Some. The BatchOperation::MintToken case sets caller = None,
bypassing KYC. Anyone can mint by submitting a batch where the first
operation is a MintToken.

Expected Outcome
Every batch route is authenticated; MintToken is admin-only within
batches.

Acceptance Criteria

• execute_batch_atomic and execute_batch_best_effort always
  call require_admin if any op is MintToken.
• Test: non-admin batch with MintToken reverts.
• check_kyc_guards.sh updated.

Files Affected

• peerx-contracts/counter/src/lib.rs, scripts/check_kyc_guards.sh.

Dependencies Issue #11.
Difficulty / Effort 🥈 / S
Labels bug, security, priority/critical

[GBOYEE]

Hi team — I'd like to take this on as part of the GrantFox campaign. I'll build the UI and open a PR referencing this issue shortly.

[nanoulloa]

Hi! This is a straightforward but important auth bypass, and I'd like to fix it properly.
The issue: execute_batch_atomic only calls require_verified_user when caller is Some, but BatchOperation::MintToken sets caller = None, so any batch starting with a MintToken op skips the KYC/auth check entirely effectively an unauthenticated mint path.
My plan:

Update execute_batch_atomic and execute_batch_best_effort in peerx-contracts/counter/src/lib.rs so that any batch containing a MintToken op forces a require_admin check up front, regardless of what caller was set to for that op.
Add a test that submits a non-admin batch containing MintToken and asserts it reverts (plus a sanity check that legitimate admin-signed batches with MintToken still succeed).
Update check_kyc_guards.sh so this guard is covered by the existing KYC guard checks.
Double check for any other BatchOperation variants with the same caller = None pattern while I'm in there, since this class of bug could repeat.

I'll reference Issue #11 as a dependency and make sure my PR doesn't conflict with whatever's landed there. Please assign it to me happy to open a draft PR quickly given the priority/critical label.

[grantfox-oss]

🦊 GrantFox — @nanoulloa has been assigned to this issue as part of the Official Campaign | FWC26 campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #39)
2. Your PR will be reviewed by the OpenPeerX maintainers

Good luck! Track your progress on GrantFox.

[grantfox-oss]

🎉 This issue has been marked as completed on GrantFox as part of the Official Campaign | FWC26 campaign!

@nanoulloa's PR #122 was approved and merged by @ameeribro4-sudo.

🏆 @nanoulloa: You earned 35 FoxPoints for this contribution! Your current tier: Explorer (134 total points). Track your full progress on GrantFox.

👏 Great work, @nanoulloa! Keep contributing to OpenPeerX.