Missing Access Control Allows Unauthorized Root Escrow Funding

Hi @coleflumpus, Thank you for the report. We've reviewed this and are closing it as Informational. While it is correct that fund_root_escrow does not restrict callers to the escrow creator, this is by design and does not constitute an exploitable vulnerability: 1. The caller transfers tokens from their own wallet - there is no path to drain or redirect funds belonging to the escrow creator. 2. The funded amount is bounded by max_claim_amount - total_funded_amount, preventing overfunding beyond the intended cap. 3. The practical impact is a griefing vector that costs the attacker real tokens with no material benefit. Allowing permissionless funding is an intentional design choice to support use cases where multiple parties (e.g., DAOs, treasuries) may contribute to the same escrow. We appreciate you looking into this. While it doesn't meet the bar for a rewarded finding, we value your interest in the security of Jupiter Lock.