fix: snapshot fee_bps at deposit time to prevent retroactive fee changes

contracts/escrow/src/lib.rs

@@ -111,13 +111,20 @@ impl EscrowContract {
             .set(&contribution_key, &Contribution { sponsor, amount });
         extend_ttl(&env, &contribution_key);
 
+        let fee_bps: u32 = env
+            .storage()
+            .instance()
+            .get(&DataKey::FeeBps)
+            .ok_or(Error::NotInitialized)?;
+
         let escrow = Escrow {
             token,
             amount,
             status: EscrowStatus::Funded,
             created_at: env.ledger().timestamp(),
             deadline,
             contributor_count: 1,
+            fee_bps,
         };
         env.storage().persistent().set(&key, &escrow);
         extend_ttl(&env, &key);
@@ -203,7 +210,7 @@ impl EscrowContract {
             EscrowStatus::Funded => {}
         }
 
-        let payouts = compute_split(&env, escrow.amount, &recipients)?;
+        let payouts = compute_split(&env, escrow.amount, &recipients, escrow.fee_bps)?;
         let treasury: Address = env.storage().instance().get(&DataKey::Treasury).unwrap();
         let token_client = token::Client::new(&env, &escrow.token);
         let contract_address = env.current_contract_address();
@@ -386,6 +393,7 @@ pub(crate) fn compute_split(
     env: &Env,
     total: i128,
     recipients: &Vec<(Address, u32)>,
+    fee_bps: u32,
 ) -> Result<Payouts, Error> {
     if recipients.is_empty() {
         return Err(Error::InvalidSplit);
@@ -399,12 +407,6 @@ pub(crate) fn compute_split(
         return Err(Error::InvalidSplit);
     }
 
-    let fee_bps: u32 = env
-        .storage()
-        .instance()
-        .get(&DataKey::FeeBps)
-        .ok_or(Error::NotInitialized)?;
-
     let fee = total * (fee_bps as i128) / BPS_DENOMINATOR;
     let distributable = total - fee;
 

contracts/escrow/src/types.rs

@@ -17,6 +17,7 @@ pub struct Escrow {
     pub created_at: u64,
     pub deadline: u64,
     pub contributor_count: u32,
+    pub fee_bps: u32,
 }
 
 /// One sponsor's contribution toward a (possibly crowdfunded) escrow.

contracts/maintenance-pool/src/lib.rs

@@ -113,6 +113,16 @@ impl MaintenancePoolContract {
     /// to `recipient` (a maintainer), as authorized off-chain by the
     /// backend oracle for completed maintenance work. Rejects if the pool
     /// balance is insufficient.
+    ///
+    /// Note on protocol fees: Unlike single-issue Escrows or Milestones,
+    /// a Maintenance Pool's balance is a blended pool of deposits made
+    /// over time, potentially by different sponsors under different historical
+    /// fee rates. Tracking individual deposit fee rates and applying them
+    /// proportionally at withdrawal time would add significant complexity.
+    /// Therefore, withdrawals always use the *current* global fee_bps at the
+    /// time of withdrawal, not the rate at deposit time. Sponsors should be
+    /// aware that the effective fee applied to their deposit may change if
+    /// the protocol fee is updated before funds are withdrawn.
     pub fn withdraw(env: Env, pool_id: u64, recipient: Address, amount: i128) -> Result<(), Error> {
         require_admin(&env)?.require_auth();
 

contracts/milestones/src/lib.rs

@@ -249,7 +249,7 @@ impl MilestonesContract {
             .get(issue_id)
             .ok_or(Error::IssueNotAllocated)?;
 
-        let payouts = compute_split(&env, amount, &recipients)?;
+        let payouts = compute_split(&env, amount, &recipients, milestone.fee_bps)?;
         let treasury: Address = env.storage().instance().get(&DataKey::Treasury).unwrap();
         let token_client = token::Client::new(&env, &milestone.token);
         let contract_address = env.current_contract_address();
@@ -346,6 +346,7 @@ fn compute_split(
     env: &Env,
     total: i128,
     recipients: &Vec<(Address, u32)>,
+    fee_bps: u32,
 ) -> Result<Payouts, Error> {
     if recipients.is_empty() {
         return Err(Error::InvalidSplit);
@@ -359,12 +360,6 @@ fn compute_split(
         return Err(Error::InvalidSplit);
     }
 
-    let fee_bps: u32 = env
-        .storage()
-        .instance()
-        .get(&DataKey::FeeBps)
-        .ok_or(Error::NotInitialized)?;
-
     let fee = total * (fee_bps as i128) / BPS_DENOMINATOR;
     let distributable = total - fee;