Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

add receive_from_unbroadcasted_transfer_to_blinded test #22

Conversation

zoedberg
Copy link
Collaborator

The test added in this PR shows what I consider a bug:
a wallet could (maliciously) accept a transfer sending to a blinded UTXO even if the transfer TX has not been broadcasted and then send the assets to another wallet (in the test, wlt_3) which will think the received allocation is valid and owned. The receiver will notice this allocation is not spendable only when it actually tries to spend it. I think the wallet should be able to differentiate an allocation coming from a history containing an unbroadcasted/unmined TX.

Run cargo test --test transfers receive_from_unbroadcasted_transfer_to_blinded -- --nocapture to see the issue.

To be merged once we have a fix for this.

@dr-orlovsky
Copy link
Member

Well, the wallet doesn't accept it: you force it to accept by providing a malicious offchain resolver. Just do not use it and that's it

@zoedberg
Copy link
Collaborator Author

zoedberg commented Nov 1, 2024

Please read the test code. The offchain resolver is used only by the malicious actor.

@zoedberg zoedberg force-pushed the receive_from_unbroadcasted_transfer_to_blinded branch from 0a9869f to ae69d03 Compare November 24, 2024 10:33
@zoedberg zoedberg merged commit ae69d03 into RGB-WG:master Nov 24, 2024
3 checks passed
Copy link

codecov bot commented Nov 24, 2024

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 36.47%. Comparing base (652630f) to head (ae69d03).
Report is 3 commits behind head on master.

Additional details and impacted files
@@            Coverage Diff             @@
##           master      #22      +/-   ##
==========================================
+ Coverage   36.42%   36.47%   +0.04%     
==========================================
  Files         279      279              
  Lines       42806    42806              
==========================================
+ Hits        15594    15612      +18     
+ Misses      27212    27194      -18     
Flag Coverage Δ
rust 36.47% <ø> (+0.04%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.


🚨 Try these New Features:

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants