feat: limit transferAndLock to only be callable by the distributor address

src/XanV1.sol

@@ -86,7 +86,8 @@ contract XanV1 is
     }
 
     /// @notice Initializes the XanV1 contract.
-    /// @param initialMintRecipient The initial recipient of the minted tokens.
+    /// @param initialMintRecipient The distributor address being the initial recipient of the minted tokens and
+    /// authorized caller of the `transferAndLock` function.
     /// @param council The address of the governance council contract.
     function initializeV1( /* solhint-disable-line comprehensive-interface*/
         address initialMintRecipient,
@@ -100,6 +101,7 @@ contract XanV1 is
 
         // Initialize the XanV1 contract
         _mint(initialMintRecipient, Parameters.SUPPLY);
+        _getLockingData().transferAndLockCaller = initialMintRecipient;
         _getCouncilData().council = council;
     }
 
@@ -110,6 +112,9 @@ contract XanV1 is
 
     /// @inheritdoc IXanV1
     function transferAndLock(address to, uint256 value) external override {
+        if (_getLockingData().transferAndLockCaller != msg.sender) {
+            revert UnauthorizedCaller({caller: msg.sender});
+        }
         _transfer({from: msg.sender, to: to, value: value});
         _lock({account: to, value: value});
     }

src/drafts/XanV2.sol

@@ -32,7 +32,8 @@ contract XanV2 is IXanV2, XanV1 {
     }
 
     /// @notice Initializes the XanV2 contract.
-    /// @param initialMintRecipient The initial recipient of the minted tokens.
+    /// @param initialMintRecipient The distributor address being the initial recipient of the minted tokens and
+    /// authorized caller of the `transferAndLock` function.
     /// @param council The address of the governance council contract.
     /// @param xanV2Forwarder The XanV2 forwarder contract.
     /// @custom:oz-upgrades-validate-as-initializer

src/interfaces/IXanV1.sol

@@ -48,7 +48,8 @@ interface IXanV1 {
     /// @param value The value to lock.
     function lock(uint256 value) external;
 
-    /// @notice Transfers tokens and immediately locks them.
+    /// @notice Transfers tokens and immediately locks them. This function is only callable by the authorized token
+    /// distributor address.
     /// @param to The receiver.
     /// @param value The value to be transferred and locked.
     function transferAndLock(address to, uint256 value) external;

src/libs/Locking.sol

@@ -9,8 +9,10 @@ library Locking {
     /// @notice A struct containing data associated with the token-locking mechanism.
     /// @param lockedBalances The locked balances associated with the current implementation.
     /// @param lockedSupply The locked total supply associated with the current implementation.
+    /// @param transferAndLockCaller The address being authorized to call the `transferAndLock` function.
     struct Data {
         mapping(address owner => uint256) lockedBalances;
         uint256 lockedSupply;
+        address transferAndLockCaller;
     }
 }

test/XanV1.locking.t.sol

@@ -108,6 +108,23 @@ contract XanV1LockingTest is Test {
         _xanProxy.transferAndLock({to: _RECEIVER, value: 1});
     }
 
+    function test_transferAndLock_reverts_if_the_caller_is_not_authorized(address other) public {
+        vm.assume(other != _defaultSender && other != address(0));
+
+        // Fund an address that is not the authorized `transferAndLock` caller.
+        uint256 value = 100;
+        {
+            vm.prank(_defaultSender);
+            _xanProxy.transfer(other, value);
+            assertEq(_xanProxy.unlockedBalanceOf(other), 100);
+        }
+
+        // Attempt to call `transferAndLock`
+        vm.prank(other);
+        vm.expectRevert(abi.encodeWithSelector(XanV1.UnauthorizedCaller.selector, other), address(_xanProxy));
+        _xanProxy.transferAndLock({to: _RECEIVER, value: value});
+    }
+
     function test_transfer_transfers_and_locks_tokens() public {
         uint256 supply = _xanProxy.totalSupply();