[huangji6693-max]

Summary

Adds docs/SECURITY_BEST_PRACTICES.md, a comprehensive smart contract security best practices guide for the StellarSplit (contracts/split and contracts/invoice-escrow) protocol.

Closes #1036

What's Included

1. Core Security Concerns & Threat Model:
   • Trust boundaries across invoice creators, payers, recipients, arbitrators, oracles, and contract admins.
   • Analysis of key risks in payment splitting, escrow releases, FX conversion, and cross-chain relays.
2. Soroban & StellarSplit Security Best Practices:
   • Authentication (require_auth()) and fine-grained RBAC (Role, Permission).
   • Reentrancy protection (ReentrancyGuard) and Checks-Effects-Interactions (CEI) ordering around SAC token transfers.
   • Safe arithmetic (checked_add, checked_mul, overflow-checks = true), rounding remainder conservation, and on-chain invariant verification.
   • Cryptographic signature domain separation and nonce/hash replay protection (PaymentIntent, BridgeProof).
   • Bounded storage (ValidationRules), centralized XDR collision-free storage keys (storage_keys.rs), and proactive TTL management.
3. Vulnerability Guide & Mitigation Catalog:
   • 8 detailed vulnerability classes (V-01 through V-08) mapped to CWE identifiers, vulnerable vs. safe code patterns, and on-chain security_audit.rs detection categories.
4. Comprehensive Security Checklists:
   • Pre-development/architecture checklist, implementation/code-review checklist, and pre-deployment/upgrade verification checklist.
5. Incident Response & Emergency Operations Runbook:
   • 5-phase operational playbook covering detection (monitoring.rs, run_contract_audit), immediate containment (emergency_pause.rs, per-function pause, circuit breaker), forensics (audit_logging.rs, verify_audit_integrity), staged remediation (contract_upgrade.rs, rollback_upgrade), and recovery verification.
6. Security References:
   • Complete internal module reference table and official Stellar/Soroban security links.