[policy-engine] ActiveProducts in instance storage grows without bound — deprecated/paused products are never pruned

[nonsobethel0-dev]

Summary

contracts/policy-engine/src/lib.rs stores all product IDs in a Vec<u128> at StorageKey::ActiveProducts in instance storage. create_product appends to this Vec (line 134). pause_product and deprecate_product only update the product's status in persistent storage — they never remove the product ID from ActiveProducts.

Code

// create_product (line 133-136) — appends
let mut products: Vec<u128> = env.storage().instance()
    .get(&StorageKey::ActiveProducts).unwrap_or_else(|| Vec::new(&env));
products.push_back(id);
env.storage().instance().set(&StorageKey::ActiveProducts, &products);

// pause_product (line 140-144) — does NOT remove from ActiveProducts
pub fn pause_product(env: Env, admin: Address, product_id: u128) {
    Self::require_admin(&env, &admin);
    let mut product: InsuranceProduct = Self::load_product(&env, product_id);
    product.status = ProductStatus::Paused;
    env.storage().persistent().set(&StorageKey::Product(product_id), &product);
    // ← product_id stays in ActiveProducts
}

Impact

• get_active_products() returns deprecated and paused product IDs alongside truly active ones — callers must re-load each product to filter
• Instance storage has a per-entry size limit (~2KB). At 16 bytes per u128, the cap is hit at ~125 products — a realistic long-term threshold for an insurance platform
• Once the size limit is hit, all subsequent create_product calls will panic

Fix

Remove the product ID from ActiveProducts in both pause_product and deprecate_product. Alternatively, name the storage key AllProducts to accurately represent its contents.

Severity: High