Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

security: resurrect comment deleted in f7fa658b #492

Merged
merged 1 commit into from
Oct 4, 2022
Merged

security: resurrect comment deleted in f7fa658b #492

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions packages/indexer-service/src/query-fees/allocations.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -89,6 +89,20 @@ export class AllocationReceiptManager implements ReceiptManager {
throw indexerError(IndexerErrorCode.IE031, 'Expecting 264 hex characters')
}

// TODO: (Security) Additional validations are required to remove trust from
// the Gateway which are deferred until we can fully remove trust which requires:
// * A receiptID based routing solution so that some invariants can be tested
// in memory instead of hitting the database for performance (eg: collateral,
// and that fees are increasing).
// * A ZKP to ensure all receipts can be collected without running out of gas.
//
// Validations include:
// * The address corresponds to an *unresolved* transfer.
// * The unresolved transfer has sufficient collateral to pay for the query.
// * Recovering the signature for the binary data in chars 20..56 = the specified address.
// * The increase in fee amount from the last known valid state covers the cost of the query
// * This receipt ID is not being "forked" by concurrent usage.

const receipt = this._parseAllocationReceipt(receiptData)
const signature = await validateSignature(
this._allocationReceiptVerifier,
Expand Down