security(contract): harden upgrade authorization and wasm hash verification

[arisu6804]

Problem

An incorrectly authorized or unverified upgrade could replace vault logic with incompatible or malicious code.

Objective

Harden the upgrade path so only the documented authority can apply an approved artifact and every failure is state-preserving.

Implementation scope

• Require the documented administrator or governance authority for upgrades.
• Verify the expected WASM hash or approved artifact metadata before applying an upgrade.
• Emit an auditable upgrade event and reject mismatches before state changes.

Acceptance criteria

• Unauthorized callers cannot upgrade the contract.
• A mismatched artifact is rejected atomically.
• A successful upgrade records the verified artifact identity.

Required validation

• Add authorization, hash mismatch, rollback, event, and state-preservation tests.
• Existing tests and CI remain passing.
• Do not weaken, delete, or skip unrelated tests to obtain a green build.

PR quality bar

• Explain the trust model, artifact verification, compatibility impact, and test evidence.
• Keep the PR focused; do not submit a docs-only or cosmetic change.

Out of scope

• Unrelated contract redesigns or broad deployment rewrites.

[Arome8240]

Hello, I'm a smart contract and full stack developer, open for contributions. contributed to over 20 project on OnlyDust and Drips , with expertise in Solidity, Cairo, JavaScript, TypeScript, and RUST. I am passionate about building secure and scalable blockchain solutions, and I would love the opportunity to contribute my skills toward solving this issue.

[grantfox-oss]

🦊 GrantFox — @Arome8240 has been assigned to this issue as part of the Third Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #78)
2. Your PR will be reviewed by the YieldVault-Org maintainers

Good luck! Track your progress on GrantFox.