-
Notifications
You must be signed in to change notification settings - Fork 859
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
fix(str): Add some changes from the internal STRv2 audit #2443
fix(str): Add some changes from the internal STRv2 audit #2443
Conversation
…ecompile addresses
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM!! Great work @MalteHerrmann!!
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM!
The failing tests are the same failling ones as on the base branch after merging #2476, which is okay as those are going to be removed in a follow-up PR. 👍 |
1717667
into
Vvaradinov/feat-strv2-feature-branch
Description
This PR adjusts some things found in the internal STR v2 audit:
maxUint256
approvals for the ERC-20 transfers was not correctly implemented. Thebank
module'sSendAuthorization
does not have the same notion of an unlimited approval (check here) as e.g. theStakeAuthorization
does (see here and here). Hence, the handling for this ERC-20 characteristic has to happen on the level of the EVM extension.common.Address{}
) did not return errors before, even though it is the case for thetransfer
,transferFrom
andapprove
methods on a standard ERC-20 Solidity contract by OpenZeppelin.OnRecvPacket
in the ERC-20 IBC middleware, we were wrongfully checking if the sender address was a module address, when rather it should be checked for the receiver.IsPositive()
rather thanIsZero() || IsNegative()
.