Add encrypted-metadata pointer field so issuers can attach off-chain disclosures with hash binding

[thlpkee20-wq]

Description

Some disclosures (PPM, K-1 templates) cannot live on-chain. Add disclosure_uri: String and disclosure_hash: BytesN<32> to offering metadata, binding off-chain documents to the contract record so investors can verify integrity.

Requirements and context

• Must be secure, tested, and documented
• Should be efficient and easy to review
• Relevant code: Revora-Contracts/src/lib.rs
• URI must be capped at 256 chars and hash exactly 32 bytes

Suggested execution

• Fork the repo and create a branch
• git checkout -b feat/encrypted-disclosure-metadata
• Implement changes
  • Add fields to offering struct and to off_reg event
  • Add update_disclosure(offering_id, uri, hash) issuer call
  • Reject URI longer than 256 chars with DisclosureUriTooLong
• Validate security and correctness assumptions

Test and commit

• Run tests
  • cargo test --all
• Cover edge cases
  • Empty URI with non-zero hash must reject InconsistentDisclosure
• Include test output and security notes

Example commit message

feat: add disclosure_uri and disclosure_hash to offering metadata

Guidelines

• Minimum 95 percent test coverage
• Clear documentation
• Timeframe: 96 hours

[bbjiggy]

@bbjiggy has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

Hi, I'd like to work on this issue.

My approach would be to extend the offering metadata with disclosure_uri and disclosure_hash (BytesN<32>) so off-chain disclosure documents are cryptographically bound to the on-chain offering record. I'll enforce a maximum URI length of 256 characters, validate that disclosure metadata is consistent (rejecting an empty URI with a non-zero hash via InconsistentDisclosure), and add an issuer-only update_disclosure(offering_id, uri, hash) function with the appropriate authorization checks. I'll also update the off_reg event to emit the new fields, ensuring indexers receive the metadata. Finally, I'll add comprehensive tests covering validation, authorization, event emission, and edge cases, run cargo test --all, and include security notes documenting the integrity guarantees and validation assumptions.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @bbjiggy to this issue.

[grantfox-oss]

🦊 GrantFox — @bbjiggy has been assigned to this issue!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #485)
2. Your PR will be reviewed by the RevoraOrg maintainers

Good luck! Track your progress on GrantFox.

[drips-wave]

Congratulations, @bbjiggy! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on June 30, 2026.

🧑‍💻 @bbjiggy: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊