contracts: Allow to associate metadata with code hashes #117
Labels
D3-involved
Can be fixed by an expert coder with good knowledge of the codebase.
I5-enhancement
An additional feature request.
We want to allow that anyone who uploads code to associate it with some metadata. This data can only be set on upload time and is as immutable as the code itself. Please note that metadata in this case does not refer to the ink! metadata which we will call ABI to avoid confusion. The structure of this metadata is not enforced by pallet-contracts but is rather subject to the ABI just as the contract calling conventions. We imagine that it will be used to tie the code to its ABI using at least those fields: ABI hash, git hash of source code, clone url of source code.
Please note that this does not defend against the original uploader of a code to supply fake metadata. It prevents third parties to submit fake source code for deterministic compilation to a block explorer. This is possible because not all parts of an ink! source code contribute to the resulting code. For example function names and message docs have no influence on the resulting code.
We change the key of a code and its associated data structures from
code_hash
tohash(code_hash ++ metadata_hash)
. We hash to not lengthen the existing key. In case no data is supplied we use the old formula of justcode_hash
. This also ensures backwards compatibility. We add themetadata_hash
to the key to allow the same code hash to exist with different metadata. This is important in case an attacker uploads a code with wrong metadata in order to block the upload with correct data. The code is stored redundant in this case. But it really only happens in case of an attack and punishes only the attacker.An alternative would be to associate the metadata with a contract instead of a code. However, that would be wasteful and would require us to change the
set_code
interface to also receive the new metadata.cc @jakoblell @cmichi
The text was updated successfully, but these errors were encountered: