-
Notifications
You must be signed in to change notification settings - Fork 204
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
How to study a genuine invite is without getting exclusive access to it? #241
Comments
Untested, but would this work? Promise.all([contractHost~.getInviteAssay(), invite~.getAssay()]).then(([a1, a2]) => a1 === a2) I think the only reason it failed for you is that you didn't compare the unwrapped assay presences, only the promises (which will always be different). |
I think we've intentionally rejected having a separate Let's suppose that Alice gives Bob an invite ERTP payment. Bob does As for @michaelfig 's example, using a response of |
Closing this, but feel free to reopen for any reason. |
These are the parts that i was missing in my reasoning. Using I'm convinced that a dedicated |
Thanks @michaelfig for the info, i had missed the part of unwrapped promises entirely! |
@katelynsills I don't have sufficient permissions on the repo to reopen, but that's my intention I agree that Pearl sets up a contract and sends an invite to Garnet. Garnet
The former case is easy. Pearl This all happens because Garnet needed to I believe there may be circumstances where you want the invite exclusivity before studying the invite and there may be other circumstances where you want to study the invite before getting exclusive access Something like I also see a (minor?) privacy issue with |
I think the invite's extent includes the contract's terms, which you can validate before claiming. invitePayment.getBalance().extent |
(i assume you mean Yes, but it happens at a moment when you don't know |
If it doesn't match the terms you wanted, you should drop it and walk away. If it matches the terms you were interested in, you can call claimAll() in the way you proposed above. The existing protocol gives the ability to compare the terms before taking exclusive access. |
Yes, i understand, but you have no way of knowing the invite is genuine before studying its source + terms One way to forge a fake invite is if you already have access to a genuine invite to the contract, you can do the following: // assumed genuineInvite object
const fakeInvite = {
getBalance(){
return genuineInvite.getBalance()
}
} If i share With |
in the old repo. this was ERTP issue 179 |
This issue follows a discussion elsewhere
Somebody hands me an alleged invite to a seat to some contract. I want 2 things before making the decision to participate:
I want both before, because i don't want to waste time studying an invite that wouldn't be genuine, but i also don't want to
redeem
it before having studied it@Chris-Hibbert suggested that
contractHost~.getInviteAssay()~.claimAll(invite)
works for the purpose of making sure the invite is genuine, but i feelclaimAll
is doing too much for what's needed herewould it be possible and make sense to add a dedicated method like
assay.validateAssetHolder(paymentOrPurse)
that would returntrue
only ifpaymentOrPurse
is of the correctassay
?It's not fully clear to me what other usage there is for
contractHost.getInviteAssay
. If there isn't any, would it make sense to replace it withvalidateInvite(invite :Payment) -> (boolean);
?The text was updated successfully, but these errors were encountered: