Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Signature alone is not enough to identify signed data #1238

Merged
merged 2 commits into from
Sep 25, 2019

Conversation

pirapira
Copy link
Contributor

but if we identify the signature and the signer, we can also identify the signed content.

What this PR does

This PR adds non_closing_address and token_network_address in RewardProofs.

Why I'm making this PR

RewardProof contained a signature non_closing_signature and we relied on that to specify a call. However, when somebody changes the signed data, our signature verification algorithm just emits a different address. So a signature alone was not enough to specify a byte blob. We need the signer's address.

Even when we can identify a byte blob, the same byte blob means different things on different token_network_address. So token_network_address is also added in the reward proof.

What's tricky about this PR (if any)

We use a signature system to establish the integrity of (token_network_address, sig, address). Within token_network_address we use the signature system again on sig, address. So the reasoning is a bit complicated.

I expect the CI to fail now, but I'm seeking feedbacks now.


Any reviewer can check these:

  • If the PR is fixing a bug or adding a feature, add an entry to CHANGELOG.md.
  • If the PR changed a Solidity source, run make compile_contracts and add the resulting raiden_contracts/data/contracts.json in the PR.
  • If the PR is changing documentation only, add [skip ci] in the commit message so Travis does not waste time.
    • But, if the PR changes comments in a Solidity source, do not add [skip ci] and let Travis check the hash of the source.
  • In Python, use keyword arguments
  • Squash unnecessary commits
  • Comment commits
  • Follow naming conventions
    • solidityFunction
    • _solidity_argument
    • solidity_variable
    • python_variable
    • PYTHON_CONSTANT
  • Follow the Signature Convention in CONTRIBUTING.md
  • For each new contract
    • The deployment script deploys the new contract.
    • etherscan_verify.py runs on the new contract.
  • Bookkeep
    • The gas cost of new functions are stored in gas.json.
  • Solidity specific conventions
    • Document arguments of functions in natspec
    • Care reentrancy problems
  • When you catch a require() failure in Solidity, look for a specific error message like pytest.raises(TransactionFailed, match="error message"):

And before "merge" all checkboxes have to be checked. If you find redundant points, remove them.

but if we identify the signature and the signer,
we can also identify the signed content.
Before this commit I saw a transaction failing with no messages.
@pirapira pirapira force-pushed the make-the-call-unique branch from 624b2da to 58beb0d Compare September 25, 2019 11:51
@codecov
Copy link

codecov bot commented Sep 25, 2019

Codecov Report

Merging #1238 into master will not change coverage.
The diff coverage is n/a.

Impacted file tree graph

@@           Coverage Diff           @@
##           master    #1238   +/-   ##
=======================================
  Coverage   81.28%   81.28%           
=======================================
  Files          21       21           
  Lines        1453     1453           
  Branches      190      190           
=======================================
  Hits         1181     1181           
  Misses        231      231           
  Partials       41       41
Impacted Files Coverage Δ
raiden_contracts/utils/proofs.py 92.3% <ø> (ø) ⬆️

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 1a40d59...58beb0d. Read the comment docs.

Copy link
Contributor

@rakanalh rakanalh left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@rakanalh rakanalh merged commit a4d41b3 into raiden-network:master Sep 25, 2019
@pirapira pirapira deleted the make-the-call-unique branch September 25, 2019 13:49
@pirapira pirapira mentioned this pull request Sep 25, 2019
15 tasks
pirapira added a commit to pirapira/spec that referenced this pull request Sep 27, 2019
These new fields were introduced in
raiden-network/raiden-contracts#1238
to remove ambiguity.

This is a part of raiden-network#254.
palango pushed a commit to raiden-network/spec that referenced this pull request Oct 7, 2019
These new fields were introduced in
raiden-network/raiden-contracts#1238
to remove ambiguity.

This is a part of #254.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants