Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Encode entity type into delegation signature #475

Closed
davidyuk opened this issue Jul 24, 2023 · 1 comment
Closed

Encode entity type into delegation signature #475

davidyuk opened this issue Jul 24, 2023 · 1 comment

Comments

@davidyuk
Copy link
Member

I've found 3 types of delegation signatures:

  1. network id + account address + contract address -- delegate AENS and Oracle operations
  2. network id + account address + name hash + contract address -- delegate an AENS name to a contract
  3. network id + query id + contract address -- delegate ability to reply to an oracle query

The addresses and ids are encoded as raw data, losing information on the entity type. In existing combinations, I can re-encode the current account address as an oracle query id and request the wallet to sign an oracle query delegation (3) and get a general delegation (1) instead.

If later we would introduce additional delegation signatures like network id + account address + channel address + contract address then functions signing a delegation of a new type can be misused to generate name delegation (2).

Currently, implementing a wallet API the correct way to name methods would be "sign network id, account address, and 32 bytes" instead of "sign network id, account address, and contract address".

The above issues may be solved by encoding address the same way as in transactions, using this mapping https://github.com/aeternity/aeserialization/blob/177bf604b2a05e940f92cf00e96e6e269e708245/src/aeser_id.erl#L97-L102

@hanssv
Copy link
Member

hanssv commented Aug 3, 2023

Again, good observation!
... and again - nothing really to do with the Sophia compiler.

@davidyuk davidyuk closed this as not planned Won't fix, can't repro, duplicate, stale Aug 4, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants