feat: enhance security send packet by adding signer and remove defaul…

…t signer
cardano-foundation · Apr 25, 2024 · 2fd6105 · 2fd6105
1 parent 5c719f5
commit 2fd6105
Show file tree

Hide file tree

Showing 14 changed files with 157 additions and 129 deletions.
diff --git a/cardano/gateway/.env.example b/cardano/gateway/.env.example
@@ -11,8 +11,6 @@ KAFKA_BROKERS=127.0.0.1:9092
 KAFKA_CONSUMER_GROUP_ID=ibc-events-group
 KAFKA_TOPIC=ibc.events
 
-SK=ed25519_sk1rvgjxs8sddhl46uqtv862s53vu4jf6lnk63rcn7f0qwzyq85wnlqgrsx42
-ADDRESS=addr_test1vz8nzrmel9mmmu97lm06uvm55cj7vny6dxjqc0y0efs8mtqsd8r5m
 KUPO_ENDPOINT=http://127.0.0.1:1442
 OGMIOS_ENDPOINT=ws://127.0.0.1:1337
 

diff --git a/cardano/gateway/src/config/index.ts b/cardano/gateway/src/config/index.ts
@@ -1,13 +1,11 @@
 import { ConnectionConfig as IOgmiosClientConfig } from '@cardano-ogmios/client';
-import signerConfig, { ISignerConfig } from './signer.config';
 import deploymentConfig, { IDeploymentConfig } from './valiator.config';
 import { connectionConfig } from './kupmios.config';
 import { PostgresConnectionOptions } from 'typeorm/driver/postgres/PostgresConnectionOptions';
 
 export interface IConfig {
   deployment: IDeploymentConfig;
   ogmiosClientConfig: IOgmiosClientConfig;
-  signer: ISignerConfig;
   ogmiosEndpoint: string;
   kupoEndpoint: string;
   database: PostgresConnectionOptions;
@@ -19,6 +17,5 @@ export default (): Partial<IConfig> => ({
   ogmiosClientConfig: connectionConfig,
   ogmiosEndpoint: process.env.OGMIOS_ENDPOINT,
   kupoEndpoint: process.env.KUPO_ENDPOINT,
-  signer: signerConfig(),
   cardanoBridgeUrl: process.env.CARDANO_BRIDGE_URL,
 });
diff --git a/cardano/gateway/src/config/signer.config.ts b/cardano/gateway/src/config/signer.config.ts
diff --git a/cardano/gateway/src/shared/modules/lucid/dtos/packet/send-packet-burn.dto.ts b/cardano/gateway/src/shared/modules/lucid/dtos/packet/send-packet-burn.dto.ts
@@ -24,6 +24,8 @@ export type UnsignedSendPacketBurnDto = {
   transferAmount: bigint;
   denomToken: string;
 
+  constructedAddress: string;
+
   sendPacketRefUTxO: UTxO;
   sendPacketPolicyId: PolicyId;
   channelToken: AuthToken;

diff --git a/cardano/gateway/src/shared/modules/lucid/dtos/packet/send-packet-escrow.dto.ts b/cardano/gateway/src/shared/modules/lucid/dtos/packet/send-packet-escrow.dto.ts
@@ -22,6 +22,8 @@ export type UnsignedSendPacketEscrowDto = {
   transferModuleAddress: string;
   denomToken: string;
 
+  constructedAddress: string;
+
   sendPacketRefUTxO: UTxO;
   sendPacketPolicyId: PolicyId;
   channelToken: AuthToken;

diff --git a/cardano/gateway/src/shared/modules/lucid/lucid.provider.ts b/cardano/gateway/src/shared/modules/lucid/lucid.provider.ts
@@ -18,10 +18,10 @@ export const LucidClient = {
     //   new Lucid.Blockfrost('https://cardano-preview.blockfrost.io/api/v0', 'preview2fjKEg2Zh687WPUwB8eljT2Mz2q045GC'),
     //   'Preview',
     // );
-    const defaultSigner = configService.get('signer').address;
-    lucid.selectWalletFrom({
-      address: defaultSigner,
-    });
+    // const defaultSigner = configService.get('signer').address;
+    // lucid.selectWalletFrom({
+    //   address: defaultSigner,
+    // });
     // lucid.selectWalletFromPrivateKey(configService.get('signer').sk);
 
     return lucid;

diff --git a/cardano/gateway/src/shared/modules/lucid/lucid.service.ts b/cardano/gateway/src/shared/modules/lucid/lucid.service.ts
@@ -773,7 +773,7 @@ export class LucidService {
   }
 
   public createUnsignedSendPacketEscrowTx(dto: UnsignedSendPacketEscrowDto): Tx {
-    const tx: Tx = this.txFromWallet(dto.senderAddress);
+    const tx: Tx = this.txFromWallet(dto.constructedAddress);
     tx.readFrom([dto.spendChannelRefUTxO, dto.spendTransferModuleUTxO, dto.sendPacketRefUTxO])
       .collectFrom([dto.channelUTxO], dto.encodedSpendChannelRedeemer)
       .collectFrom([dto.transferModuleUTxO], dto.encodedSpendTransferModuleRedeemer)
@@ -814,7 +814,7 @@ export class LucidService {
   public createUnsignedSendPacketBurnTx(dto: UnsignedSendPacketBurnDto): Tx {
     const deploymentConfig = this.configService.get('deployment');
 
-    const tx: Tx = this.txFromWallet(dto.senderAddress);
+    const tx: Tx = this.txFromWallet(dto.constructedAddress);
     tx.readFrom([dto.spendChannelRefUTxO, dto.spendTransferModuleUTxO, dto.mintVoucherRefUtxo, dto.sendPacketRefUTxO])
       .collectFrom([dto.channelUTxO], dto.encodedSpendChannelRedeemer)
       .collectFrom([dto.transferModuleUTxO], dto.encodedSpendTransferModuleRedeemer)

diff --git a/cardano/gateway/src/tx/dto/packet/send-packet-operator.dto.ts b/cardano/gateway/src/tx/dto/packet/send-packet-operator.dto.ts
@@ -10,6 +10,7 @@ export type SendPacketOperator = {
   token: Coin;
   sender: string;
   receiver: string;
+  signer: string;
   timeoutHeight: Height;
   timeoutTimestamp: bigint;
   memo: string;

diff --git a/cardano/gateway/src/tx/helper/packet.validate.ts b/cardano/gateway/src/tx/helper/packet.validate.ts
@@ -5,7 +5,12 @@ import { MerkleProof } from '@plus/proto-types/build/ibc/core/commitment/v1/comm
 import { RecvPacketOperator } from '../dto/packet/recv-packet-operator.dto';
 import { convertHex2String, convertString2Hex, toHex } from '@shared/helpers/hex';
 import { initializeMerkleProof } from '@shared/helpers/merkle-proof';
-import { MsgAcknowledgement, MsgRecvPacket, MsgTimeout, MsgTransfer } from '@plus/proto-types/build/ibc/core/channel/v1/tx';
+import {
+  MsgAcknowledgement,
+  MsgRecvPacket,
+  MsgTimeout,
+  MsgTransfer,
+} from '@plus/proto-types/build/ibc/core/channel/v1/tx';
 import { SendPacketOperator } from '../dto/packet/send-packet-operator.dto';
 import { FungibleTokenPacketDatum } from '@shared/types/apps/transfer/types/fungible-token-packet-data';
 import { TimeoutPacketOperator } from '../dto/packet/time-out-packet-operator.dto';
@@ -58,6 +63,9 @@ export function validateAndFormatSendPacketParams(data: MsgTransfer): SendPacket
     throw new GrpcInvalidArgumentException(
       `Invalid argument: "source_channel". Please use the prefix "${CHANNEL_ID_PREFIX}-"`,
     );
+  if (!data.signer) {
+    throw new GrpcInvalidArgumentException('Invalid constructed address: signer is not valid');
+  }
 
   // Prepare the Recv packet operator object
   const sendPacketOperator: SendPacketOperator = {
@@ -69,6 +77,7 @@ export function validateAndFormatSendPacketParams(data: MsgTransfer): SendPacket
     },
     sender: data.sender,
     receiver: data.receiver,
+    signer: data.signer,
     timeoutHeight: {
       revisionHeight: BigInt(data.timeout_height?.revision_height || 0),
       revisionNumber: BigInt(data.timeout_height?.revision_number || 0),

diff --git a/cardano/gateway/src/tx/packet.service.ts b/cardano/gateway/src/tx/packet.service.ts
@@ -894,6 +894,8 @@ export class PacketService {
         senderAddress,
         receiverAddress: sendPacketOperator.receiver,
 
+        constructedAddress: sendPacketOperator.signer,
+
         channelTokenUnit,
         voucherTokenUnit,
         denomToken: normalizeDenomTokenTransfer(sendPacketOperator.token.denom),
@@ -923,6 +925,8 @@ export class PacketService {
       senderAddress: sendPacketOperator.sender,
       receiverAddress: sendPacketOperator.receiver,
 
+      constructedAddress: sendPacketOperator.signer,
+
       spendChannelAddress: deploymentConfig.validators.spendChannel.address,
       channelTokenUnit: channelTokenUnit,
       transferModuleAddress: deploymentConfig.modules.transfer.address,

diff --git a/cardano/gateway/src/tx/test/mock/msg-send-packet.ts b/cardano/gateway/src/tx/test/mock/msg-send-packet.ts
@@ -16,6 +16,7 @@ class MsgSendPacketMockBuilder {
         amount: 3000n,
       },
       sender: '247570b8ba7dc725e9ff37e9757b8148b4d5a125958edac2fd4417b8',
+      signer: '247570b8ba7dc725e9ff37e9757b8148b4d5a125958edac2fd4417b8',
       receiver: 'cosmos1ycel53a5d9xk89q3vdr7vm839t2vwl08pl6zk6',
       timeout_height: null,
       timeout_timestamp: 968124724398584011n,