From 4b2482621ba2db8ce69a923d641367241060cb5f Mon Sep 17 00:00:00 2001
From: sudiptapaul <psudipta858@gmail.com>
Date: Fri, 24 Jul 2026 19:55:52 +0530
Subject: [PATCH 1/9] fix(agent-vault): add no-op rotation rejection for admin
 and orchestrator

---
 contracts/agent-vault/src/lib.rs   |  12 +++
 contracts/agent-vault/src/tests.rs | 144 +++++++++++++++++++++++++++++
 2 files changed, 156 insertions(+)

diff --git a/contracts/agent-vault/src/lib.rs b/contracts/agent-vault/src/lib.rs
index a39ae38..874381b 100644
--- a/contracts/agent-vault/src/lib.rs
+++ b/contracts/agent-vault/src/lib.rs
@@ -132,6 +132,7 @@ pub enum VaultError {
     NotYourTask = 16,
     NotYourOrchestrator = 17,
     TooManyActiveTasks = 18,
+    NoChange = 19,
 }
 
 // Storage keys
@@ -564,6 +565,7 @@ impl AgentVault {
 
     /// Update the registered orchestrator for a user. Requires no active tasks so
     /// in-flight task authorization cannot be stranded on the old orchestrator.
+    /// Rejects if new_orchestrator equals the current orchestrator (no-op check).
     pub fn update_orchestrator(
         env: Env,
         user: Address,
@@ -597,6 +599,11 @@ impl AgentVault {
             }
         }
 
+        // Reject no-op rotation: new_orchestrator must differ from old orchestrator
+        if new_orchestrator == old_orchestrator {
+            return Err(VaultError::NoChange);
+        }
+
         let old_owner_key = DataKey::OrchestratorOwner(old_orchestrator.clone());
         env.storage().persistent().remove(&old_owner_key);
 
@@ -1324,6 +1331,7 @@ impl AgentVault {
     }
 
     /// Rotates the admin key. Only the current admin can call this.
+    /// Rejects if new_admin equals the current admin (no-op check).
     /// Emits UpdateAdminEvent on success.
     pub fn update_admin(env: Env, admin: Address, new_admin: Address) -> Result<(), VaultError> {
         admin.require_auth();
@@ -1335,6 +1343,10 @@ impl AgentVault {
         if admin != stored_admin {
             return Err(VaultError::Unauthorized);
         }
+        // Reject no-op rotation: new_admin must differ from current admin
+        if new_admin == stored_admin {
+            return Err(VaultError::NoChange);
+        }
         env.storage().instance().set(&DataKey::Admin, &new_admin);
         Self::extend_instance_ttl(&env);
         UpdateAdminEvent {
diff --git a/contracts/agent-vault/src/tests.rs b/contracts/agent-vault/src/tests.rs
index e0a13ea..1c0350b 100644
--- a/contracts/agent-vault/src/tests.rs
+++ b/contracts/agent-vault/src/tests.rs
@@ -2561,3 +2561,147 @@ fn test_version_returns_contract_version() {
     let test_env = setup_test();
     assert_eq!(test_env.client.version(), 2);
 }
+
+
+// ── No-op rotation rejection tests ───────────────────────────────────────────
+
+/// Negative: admin cannot rotate to the same admin (no-op check).
+#[test]
+fn test_update_admin_rejects_no_op_rotation() {
+    let t = setup_test();
+    t.client.init(&t.admin, &t.usdc_sac);
+
+    // Attempt to rotate to the same admin
+    let result = t.client.try_update_admin(&t.admin, &t.admin);
+    assert!(result == Err(Ok(VaultError::NoChange)));
+
+    // Verify admin is still the same
+    let stored = t.client.get_admin();
+    assert_eq!(stored, t.admin);
+}
+
+/// Negative: orchestrator cannot be updated to the current orchestrator (no-op check).
+#[test]
+fn test_update_orchestrator_rejects_no_op_rotation() {
+    let test_env = setup_test();
+    test_env.client.init(&test_env.admin, &test_env.usdc_sac);
+
+    let user = Address::generate(&test_env.env);
+    let orchestrator = Address::generate(&test_env.env);
+    let name = soroban_sdk::String::from_str(&test_env.env, "MyOrchestrator");
+
+    // Register orchestrator first
+    test_env
+        .client
+        .register_orchestrator(&user, &orchestrator, &name);
+
+    // Attempt to update to the same orchestrator with same name
+    let result = test_env
+        .client
+        .try_update_orchestrator(&user, &orchestrator, &name);
+    assert!(result == Err(Ok(VaultError::NoChange)));
+
+    // Verify orchestrator is still the same
+    let config = test_env.client.get_user_config(&user).unwrap();
+    assert_eq!(config.orchestrator, Some(orchestrator.clone()));
+    assert_eq!(config.orchestrator_name, name);
+}
+
+/// Positive: legitimate admin rotation still works after no-op check.
+#[test]
+fn test_update_admin_legitimate_rotation_still_works() {
+    let t = setup_test();
+    t.client.init(&t.admin, &t.usdc_sac);
+    let new_admin = Address::generate(&t.env);
+    let another_admin = Address::generate(&t.env);
+
+    // First rotation succeeds
+    t.client.update_admin(&t.admin, &new_admin);
+    assert_eq!(t.client.get_admin(), new_admin);
+
+    // Second legitimate rotation also succeeds
+    t.client.update_admin(&new_admin, &another_admin);
+    assert_eq!(t.client.get_admin(), another_admin);
+}
+
+/// Positive: legitimate orchestrator rotation still works after no-op check.
+#[test]
+fn test_update_orchestrator_legitimate_rotation_still_works() {
+    let test_env = setup_test();
+    test_env.client.init(&test_env.admin, &test_env.usdc_sac);
+
+    let user = Address::generate(&test_env.env);
+    let old_orchestrator = Address::generate(&test_env.env);
+    let new_orchestrator = Address::generate(&test_env.env);
+    let old_name = soroban_sdk::String::from_str(&test_env.env, "OldOrchestrator");
+    let new_name = soroban_sdk::String::from_str(&test_env.env, "NewOrchestrator");
+
+    // Register original orchestrator
+    test_env
+        .client
+        .register_orchestrator(&user, &old_orchestrator, &old_name);
+
+    // First legitimate rotation succeeds
+    test_env
+        .client
+        .update_orchestrator(&user, &new_orchestrator, &new_name);
+    let config = test_env.client.get_user_config(&user).unwrap();
+    assert_eq!(config.orchestrator, Some(new_orchestrator.clone()));
+    assert_eq!(config.orchestrator_name, new_name);
+
+    // Second legitimate rotation also succeeds (update to a different orchestrator)
+    let another_orchestrator = Address::generate(&test_env.env);
+    let another_name = soroban_sdk::String::from_str(&test_env.env, "AnotherOrchestrator");
+    test_env
+        .client
+        .update_orchestrator(&user, &another_orchestrator, &another_name);
+    let config2 = test_env.client.get_user_config(&user).unwrap();
+    assert_eq!(config2.orchestrator, Some(another_orchestrator.clone()));
+    assert_eq!(config2.orchestrator_name, another_name);
+}
+
+/// Verify that no-op admin rotation produces no events.
+#[test]
+fn test_update_admin_no_op_emits_no_event() {
+    let t = setup_test();
+    t.client.init(&t.admin, &t.usdc_sac);
+
+    // Clear any init events
+    let _ = t.env.events().all();
+
+    // Attempt no-op rotation (should fail and emit no event)
+    let result = t.client.try_update_admin(&t.admin, &t.admin);
+    assert!(result == Err(Ok(VaultError::NoChange)));
+
+    // Verify no event was emitted
+    let events = t.env.events().all();
+    assert_eq!(events.events().len(), 0);
+}
+
+/// Verify that no-op orchestrator rotation produces no events.
+#[test]
+fn test_update_orchestrator_no_op_emits_no_event() {
+    let test_env = setup_test();
+    test_env.client.init(&test_env.admin, &test_env.usdc_sac);
+
+    let user = Address::generate(&test_env.env);
+    let orchestrator = Address::generate(&test_env.env);
+    let name = soroban_sdk::String::from_str(&test_env.env, "MyOrchestrator");
+
+    test_env
+        .client
+        .register_orchestrator(&user, &orchestrator, &name);
+
+    // Clear any registration events
+    let _ = test_env.env.events().all();
+
+    // Attempt no-op rotation (should fail and emit no event)
+    let result = test_env
+        .client
+        .try_update_orchestrator(&user, &orchestrator, &name);
+    assert!(result == Err(Ok(VaultError::NoChange)));
+
+    // Verify no event was emitted
+    let events = test_env.env.events().all();
+    assert_eq!(events.events().len(), 0);
+}

From f34a6dda09dd0f45d099b9a99ca61fbd32457a4f Mon Sep 17 00:00:00 2001
From: sudiptapaul <psudipta858@gmail.com>
Date: Fri, 24 Jul 2026 20:04:36 +0530
Subject: [PATCH 2/9] fix(agent-vault): defer TTL refresh until after no-op
 rotation validation

---
 contracts/agent-vault/src/lib.rs   |  6 +++--
 contracts/agent-vault/src/tests.rs | 36 ++++++++++++++++--------------
 2 files changed, 23 insertions(+), 19 deletions(-)

diff --git a/contracts/agent-vault/src/lib.rs b/contracts/agent-vault/src/lib.rs
index 874381b..213d550 100644
--- a/contracts/agent-vault/src/lib.rs
+++ b/contracts/agent-vault/src/lib.rs
@@ -580,7 +580,6 @@ impl AgentVault {
             .persistent()
             .get(&config_key)
             .ok_or(VaultError::OrchestratorNotRegistered)?;
-        Self::extend_persistent_ttl(&env, &config_key);
 
         if config.active_tasks_count != 0 {
             return Err(VaultError::ActiveTaskExists);
@@ -593,17 +592,20 @@ impl AgentVault {
 
         let new_owner_key = DataKey::OrchestratorOwner(new_orchestrator.clone());
         if let Some(existing_owner) = env.storage().persistent().get::<_, Address>(&new_owner_key) {
-            Self::extend_persistent_ttl(&env, &new_owner_key);
             if existing_owner != user {
                 return Err(VaultError::OrchestratorAlreadyRegistered);
             }
         }
 
         // Reject no-op rotation: new_orchestrator must differ from old orchestrator
+        // This check comes BEFORE any TTL refreshes or state mutations
         if new_orchestrator == old_orchestrator {
             return Err(VaultError::NoChange);
         }
 
+        // All validations passed; now refresh TTLs and perform state writes
+        Self::extend_persistent_ttl(&env, &config_key);
+
         let old_owner_key = DataKey::OrchestratorOwner(old_orchestrator.clone());
         env.storage().persistent().remove(&old_owner_key);
 
diff --git a/contracts/agent-vault/src/tests.rs b/contracts/agent-vault/src/tests.rs
index 1c0350b..9150759 100644
--- a/contracts/agent-vault/src/tests.rs
+++ b/contracts/agent-vault/src/tests.rs
@@ -2565,7 +2565,7 @@ fn test_version_returns_contract_version() {
 
 // ── No-op rotation rejection tests ───────────────────────────────────────────
 
-/// Negative: admin cannot rotate to the same admin (no-op check).
+/// Verify that no-op admin rotation is rejected without state changes.
 #[test]
 fn test_update_admin_rejects_no_op_rotation() {
     let t = setup_test();
@@ -2580,7 +2580,7 @@ fn test_update_admin_rejects_no_op_rotation() {
     assert_eq!(stored, t.admin);
 }
 
-/// Negative: orchestrator cannot be updated to the current orchestrator (no-op check).
+/// Verify that no-op orchestrator rotation is rejected without state changes.
 #[test]
 fn test_update_orchestrator_rejects_no_op_rotation() {
     let test_env = setup_test();
@@ -2660,27 +2660,27 @@ fn test_update_orchestrator_legitimate_rotation_still_works() {
     assert_eq!(config2.orchestrator_name, another_name);
 }
 
-/// Verify that no-op admin rotation produces no events.
+/// Verify that legitimate admin rotation emits exactly one event.
 #[test]
-fn test_update_admin_no_op_emits_no_event() {
+fn test_update_admin_legitimate_rotation_emits_event() {
     let t = setup_test();
     t.client.init(&t.admin, &t.usdc_sac);
+    let new_admin = Address::generate(&t.env);
 
     // Clear any init events
     let _ = t.env.events().all();
 
-    // Attempt no-op rotation (should fail and emit no event)
-    let result = t.client.try_update_admin(&t.admin, &t.admin);
-    assert!(result == Err(Ok(VaultError::NoChange)));
+    // Perform legitimate rotation
+    t.client.update_admin(&t.admin, &new_admin);
 
-    // Verify no event was emitted
+    // Verify exactly one event was emitted
     let events = t.env.events().all();
-    assert_eq!(events.events().len(), 0);
+    assert_eq!(events.events().len(), 1);
 }
 
-/// Verify that no-op orchestrator rotation produces no events.
+/// Verify that legitimate orchestrator rotation emits exactly one event.
 #[test]
-fn test_update_orchestrator_no_op_emits_no_event() {
+fn test_update_orchestrator_legitimate_rotation_emits_event() {
     let test_env = setup_test();
     test_env.client.init(&test_env.admin, &test_env.usdc_sac);
 
@@ -2695,13 +2695,15 @@ fn test_update_orchestrator_no_op_emits_no_event() {
     // Clear any registration events
     let _ = test_env.env.events().all();
 
-    // Attempt no-op rotation (should fail and emit no event)
-    let result = test_env
+    let new_orchestrator = Address::generate(&test_env.env);
+    let new_name = soroban_sdk::String::from_str(&test_env.env, "NewOrchestrator");
+
+    // Perform legitimate rotation
+    test_env
         .client
-        .try_update_orchestrator(&user, &orchestrator, &name);
-    assert!(result == Err(Ok(VaultError::NoChange)));
+        .update_orchestrator(&user, &new_orchestrator, &new_name);
 
-    // Verify no event was emitted
+    // Verify exactly one event was emitted
     let events = test_env.env.events().all();
-    assert_eq!(events.events().len(), 0);
+    assert_eq!(events.events().len(), 1);
 }

From d3650d85726975b47523d154f5f5270a46997a2c Mon Sep 17 00:00:00 2001
From: sudiptapaul <psudipta858@gmail.com>
Date: Fri, 24 Jul 2026 20:16:24 +0530
Subject: [PATCH 3/9] test(agent-vault): remove decorative comment formatting
 in tests

---
 contracts/agent-vault/src/tests.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/contracts/agent-vault/src/tests.rs b/contracts/agent-vault/src/tests.rs
index 9150759..26ac0f4 100644
--- a/contracts/agent-vault/src/tests.rs
+++ b/contracts/agent-vault/src/tests.rs
@@ -2563,7 +2563,7 @@ fn test_version_returns_contract_version() {
 }
 
 
-// ── No-op rotation rejection tests ───────────────────────────────────────────
+// No-op rotation rejection tests
 
 /// Verify that no-op admin rotation is rejected without state changes.
 #[test]

From d297b97e2c64bdf8cb29f6cd97211593f9fed882 Mon Sep 17 00:00:00 2001
From: sudiptapaul <psudipta858@gmail.com>
Date: Fri, 24 Jul 2026 20:22:27 +0530
Subject: [PATCH 4/9] style(agent-vault): remove decorative formatting from
 section comments

---
 contracts/agent-vault/src/lib.rs   | 6 +++---
 contracts/agent-vault/src/tests.rs | 3 +--
 2 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/contracts/agent-vault/src/lib.rs b/contracts/agent-vault/src/lib.rs
index 213d550..de1ccac 100644
--- a/contracts/agent-vault/src/lib.rs
+++ b/contracts/agent-vault/src/lib.rs
@@ -1203,7 +1203,7 @@ impl AgentVault {
         result
     }
 
-    // ── Pause / Unpause ─────────────────────────────────────────────────
+    // Pause / Unpause
 
     /// Pauses the contract, blocking deposit, create_task, and release_payment.
     pub fn pause(env: Env, admin: Address) -> Result<(), VaultError> {
@@ -1258,7 +1258,7 @@ impl AgentVault {
         paused
     }
 
-    // ── Stale Task Threshold Management ────────────────────────────────
+    // Stale Task Threshold Management
 
     /// Admin updates the threshold (in seconds) after which a task is considered stale.
     pub fn set_stale_threshold(env: Env, admin: Address, seconds: u64) -> Result<(), VaultError> {
@@ -1296,7 +1296,7 @@ impl AgentVault {
         threshold
     }
 
-    // ── Max Active Tasks Management ────────────────────────────────────
+    // Max Active Tasks Management
 
     /// Admin updates the cap on concurrent active tasks a single user may hold.
     pub fn set_max_active_tasks(env: Env, admin: Address, max: u32) -> Result<(), VaultError> {
diff --git a/contracts/agent-vault/src/tests.rs b/contracts/agent-vault/src/tests.rs
index 26ac0f4..8b56385 100644
--- a/contracts/agent-vault/src/tests.rs
+++ b/contracts/agent-vault/src/tests.rs
@@ -1976,8 +1976,7 @@ fn test_lowering_cap_below_current_count_does_not_affect_existing_tasks() {
     let third_task_id = t.client.create_task(&orchestrator, &t.usdc_sac, &100);
     assert_eq!(third_task_id, 3);
 }
-
-// ── Admin key rotation tests ─────────────────────────────────────────────────
+// Admin key rotation tests
 
 /// Positive: admin rotates to new_admin successfully.
 #[test]

From fe1c4e79e2454d9752422098fbce49e99279d16d Mon Sep 17 00:00:00 2001
From: sudiptapaul <psudipta858@gmail.com>
Date: Mon, 27 Jul 2026 17:58:42 +0530
Subject: [PATCH 5/9] test(agent-vault): remove duplicate import in tests

---
 contracts/agent-vault/src/tests.rs | 1 +
 1 file changed, 1 insertion(+)

diff --git a/contracts/agent-vault/src/tests.rs b/contracts/agent-vault/src/tests.rs
index 8489176..05c47e1 100644
--- a/contracts/agent-vault/src/tests.rs
+++ b/contracts/agent-vault/src/tests.rs
@@ -1,4 +1,5 @@
 use crate::{AgentVault, AgentVaultClient, DataKey, VaultError};
+use crate::{AgentVault, AgentVaultClient, VaultError};
 use soroban_sdk::testutils::storage::Persistent as _;
 use soroban_sdk::testutils::{Address as _, Events, Ledger as _};
 use soroban_sdk::{token, Address, Env};

From 94c6552b2082eac7c1df9ded4546819816b764e4 Mon Sep 17 00:00:00 2001
From: sudiptapaul <psudipta858@gmail.com>
Date: Mon, 27 Jul 2026 18:11:07 +0530
Subject: [PATCH 6/9] test(agent-vault): improve state verification in rotation
 tests

---
 contracts/agent-vault/src/tests.rs | 48 +++++++++++++++++++-----------
 1 file changed, 30 insertions(+), 18 deletions(-)

diff --git a/contracts/agent-vault/src/tests.rs b/contracts/agent-vault/src/tests.rs
index 05c47e1..984e49d 100644
--- a/contracts/agent-vault/src/tests.rs
+++ b/contracts/agent-vault/src/tests.rs
@@ -2651,13 +2651,17 @@ fn test_update_admin_rejects_no_op_rotation() {
     let t = setup_test();
     t.client.init(&t.admin, &t.usdc_sac);
 
-    // Attempt to rotate to the same admin
+    // Store admin before attempting no-op
+    let before = t.client.get_admin();
+    assert_eq!(before, t.admin);
+
+    // Attempt to rotate to the same admin - should return NoChange error
     let result = t.client.try_update_admin(&t.admin, &t.admin);
     assert!(result == Err(Ok(VaultError::NoChange)));
 
-    // Verify admin is still the same
-    let stored = t.client.get_admin();
-    assert_eq!(stored, t.admin);
+    // Verify admin is unchanged
+    let after = t.client.get_admin();
+    assert_eq!(after, before);
 }
 
 /// Verify that no-op orchestrator rotation is rejected without state changes.
@@ -2675,16 +2679,21 @@ fn test_update_orchestrator_rejects_no_op_rotation() {
         .client
         .register_orchestrator(&user, &orchestrator, &name);
 
-    // Attempt to update to the same orchestrator with same name
+    // Store state before attempting no-op
+    let config_before = test_env.client.get_user_config(&user).unwrap();
+    assert_eq!(config_before.orchestrator, Some(orchestrator.clone()));
+    assert_eq!(config_before.orchestrator_name, name.clone());
+
+    // Attempt to update to the same orchestrator - should return NoChange error
     let result = test_env
         .client
         .try_update_orchestrator(&user, &orchestrator, &name);
     assert!(result == Err(Ok(VaultError::NoChange)));
 
-    // Verify orchestrator is still the same
-    let config = test_env.client.get_user_config(&user).unwrap();
-    assert_eq!(config.orchestrator, Some(orchestrator.clone()));
-    assert_eq!(config.orchestrator_name, name);
+    // Verify orchestrator is unchanged
+    let config_after = test_env.client.get_user_config(&user).unwrap();
+    assert_eq!(config_after.orchestrator, Some(orchestrator.clone()));
+    assert_eq!(config_after.orchestrator_name, name);
 }
 
 /// Positive: legitimate admin rotation still works after no-op check.
@@ -2696,11 +2705,11 @@ fn test_update_admin_legitimate_rotation_still_works() {
     let another_admin = Address::generate(&t.env);
 
     // First rotation succeeds
-    t.client.update_admin(&t.admin, &new_admin);
+    assert!(t.client.try_update_admin(&t.admin, &new_admin).is_ok());
     assert_eq!(t.client.get_admin(), new_admin);
 
     // Second legitimate rotation also succeeds
-    t.client.update_admin(&new_admin, &another_admin);
+    assert!(t.client.try_update_admin(&new_admin, &another_admin).is_ok());
     assert_eq!(t.client.get_admin(), another_admin);
 }
 
@@ -2722,9 +2731,10 @@ fn test_update_orchestrator_legitimate_rotation_still_works() {
         .register_orchestrator(&user, &old_orchestrator, &old_name);
 
     // First legitimate rotation succeeds
-    test_env
+    assert!(test_env
         .client
-        .update_orchestrator(&user, &new_orchestrator, &new_name);
+        .try_update_orchestrator(&user, &new_orchestrator, &new_name)
+        .is_ok());
     let config = test_env.client.get_user_config(&user).unwrap();
     assert_eq!(config.orchestrator, Some(new_orchestrator.clone()));
     assert_eq!(config.orchestrator_name, new_name);
@@ -2732,9 +2742,10 @@ fn test_update_orchestrator_legitimate_rotation_still_works() {
     // Second legitimate rotation also succeeds (update to a different orchestrator)
     let another_orchestrator = Address::generate(&test_env.env);
     let another_name = soroban_sdk::String::from_str(&test_env.env, "AnotherOrchestrator");
-    test_env
+    assert!(test_env
         .client
-        .update_orchestrator(&user, &another_orchestrator, &another_name);
+        .try_update_orchestrator(&user, &another_orchestrator, &another_name)
+        .is_ok());
     let config2 = test_env.client.get_user_config(&user).unwrap();
     assert_eq!(config2.orchestrator, Some(another_orchestrator.clone()));
     assert_eq!(config2.orchestrator_name, another_name);
@@ -2751,7 +2762,7 @@ fn test_update_admin_legitimate_rotation_emits_event() {
     let _ = t.env.events().all();
 
     // Perform legitimate rotation
-    t.client.update_admin(&t.admin, &new_admin);
+    assert!(t.client.try_update_admin(&t.admin, &new_admin).is_ok());
 
     // Verify exactly one event was emitted
     let events = t.env.events().all();
@@ -2779,9 +2790,10 @@ fn test_update_orchestrator_legitimate_rotation_emits_event() {
     let new_name = soroban_sdk::String::from_str(&test_env.env, "NewOrchestrator");
 
     // Perform legitimate rotation
-    test_env
+    assert!(test_env
         .client
-        .update_orchestrator(&user, &new_orchestrator, &new_name);
+        .try_update_orchestrator(&user, &new_orchestrator, &new_name)
+        .is_ok());
 
     // Verify exactly one event was emitted
     let events = test_env.env.events().all();

From d91b7a3e80eda1cdd946f25d380297c9547f4dfd Mon Sep 17 00:00:00 2001
From: sudiptapaul <psudipta858@gmail.com>
Date: Mon, 27 Jul 2026 18:14:27 +0530
Subject: [PATCH 7/9] fix(agent-vault): use correct admin variable in
 UpdateAdminEvent

---
 contracts/agent-vault/src/lib.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/contracts/agent-vault/src/lib.rs b/contracts/agent-vault/src/lib.rs
index 8b83922..a41568e 100644
--- a/contracts/agent-vault/src/lib.rs
+++ b/contracts/agent-vault/src/lib.rs
@@ -1384,7 +1384,7 @@ impl AgentVault {
         env.storage().instance().set(&DataKey::Admin, &new_admin);
         Self::extend_instance_ttl(&env);
         UpdateAdminEvent {
-            old_admin: admin,
+            old_admin: stored_admin,
             new_admin,
         }
         .publish(&env);

From f4e988f6300b003a5f62d6335bc76e91cadc2a63 Mon Sep 17 00:00:00 2001
From: sudiptapaul <psudipta858@gmail.com>
Date: Mon, 27 Jul 2026 18:17:13 +0530
Subject: [PATCH 8/9] quick fix

---
 contracts/agent-vault/src/tests.rs | 1 -
 1 file changed, 1 deletion(-)

diff --git a/contracts/agent-vault/src/tests.rs b/contracts/agent-vault/src/tests.rs
index 984e49d..830bf1e 100644
--- a/contracts/agent-vault/src/tests.rs
+++ b/contracts/agent-vault/src/tests.rs
@@ -1,4 +1,3 @@
-use crate::{AgentVault, AgentVaultClient, DataKey, VaultError};
 use crate::{AgentVault, AgentVaultClient, VaultError};
 use soroban_sdk::testutils::storage::Persistent as _;
 use soroban_sdk::testutils::{Address as _, Events, Ledger as _};

From 5faf3176a851257a6a529a5112ccf7972fdd7fda Mon Sep 17 00:00:00 2001
From: sudiptapaul <psudipta858@gmail.com>
Date: Mon, 27 Jul 2026 18:23:19 +0530
Subject: [PATCH 9/9] minor fix

---
 contracts/agent-vault/src/tests.rs | 22 ++++++++++------------
 1 file changed, 10 insertions(+), 12 deletions(-)

diff --git a/contracts/agent-vault/src/tests.rs b/contracts/agent-vault/src/tests.rs
index 830bf1e..62664e2 100644
--- a/contracts/agent-vault/src/tests.rs
+++ b/contracts/agent-vault/src/tests.rs
@@ -1,3 +1,4 @@
+ use crate::{AgentVault, AgentVaultClient, VaultError};
 use crate::{AgentVault, AgentVaultClient, VaultError};
 use soroban_sdk::testutils::storage::Persistent as _;
 use soroban_sdk::testutils::{Address as _, Events, Ledger as _};
@@ -2704,11 +2705,11 @@ fn test_update_admin_legitimate_rotation_still_works() {
     let another_admin = Address::generate(&t.env);
 
     // First rotation succeeds
-    assert!(t.client.try_update_admin(&t.admin, &new_admin).is_ok());
+    t.client.update_admin(&t.admin, &new_admin);
     assert_eq!(t.client.get_admin(), new_admin);
 
     // Second legitimate rotation also succeeds
-    assert!(t.client.try_update_admin(&new_admin, &another_admin).is_ok());
+    t.client.update_admin(&new_admin, &another_admin);
     assert_eq!(t.client.get_admin(), another_admin);
 }
 
@@ -2730,10 +2731,9 @@ fn test_update_orchestrator_legitimate_rotation_still_works() {
         .register_orchestrator(&user, &old_orchestrator, &old_name);
 
     // First legitimate rotation succeeds
-    assert!(test_env
+    test_env
         .client
-        .try_update_orchestrator(&user, &new_orchestrator, &new_name)
-        .is_ok());
+        .update_orchestrator(&user, &new_orchestrator, &new_name);
     let config = test_env.client.get_user_config(&user).unwrap();
     assert_eq!(config.orchestrator, Some(new_orchestrator.clone()));
     assert_eq!(config.orchestrator_name, new_name);
@@ -2741,10 +2741,9 @@ fn test_update_orchestrator_legitimate_rotation_still_works() {
     // Second legitimate rotation also succeeds (update to a different orchestrator)
     let another_orchestrator = Address::generate(&test_env.env);
     let another_name = soroban_sdk::String::from_str(&test_env.env, "AnotherOrchestrator");
-    assert!(test_env
+    test_env
         .client
-        .try_update_orchestrator(&user, &another_orchestrator, &another_name)
-        .is_ok());
+        .update_orchestrator(&user, &another_orchestrator, &another_name);
     let config2 = test_env.client.get_user_config(&user).unwrap();
     assert_eq!(config2.orchestrator, Some(another_orchestrator.clone()));
     assert_eq!(config2.orchestrator_name, another_name);
@@ -2761,7 +2760,7 @@ fn test_update_admin_legitimate_rotation_emits_event() {
     let _ = t.env.events().all();
 
     // Perform legitimate rotation
-    assert!(t.client.try_update_admin(&t.admin, &new_admin).is_ok());
+    t.client.update_admin(&t.admin, &new_admin);
 
     // Verify exactly one event was emitted
     let events = t.env.events().all();
@@ -2789,10 +2788,9 @@ fn test_update_orchestrator_legitimate_rotation_emits_event() {
     let new_name = soroban_sdk::String::from_str(&test_env.env, "NewOrchestrator");
 
     // Perform legitimate rotation
-    assert!(test_env
+    test_env
         .client
-        .try_update_orchestrator(&user, &new_orchestrator, &new_name)
-        .is_ok());
+        .update_orchestrator(&user, &new_orchestrator, &new_name);
 
     // Verify exactly one event was emitted
     let events = test_env.env.events().all();