-
Notifications
You must be signed in to change notification settings - Fork 3
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
add gasclaim #6
add gasclaim #6
Conversation
@@ -10,6 +10,8 @@ namespace CNEO | |||
{ | |||
public class CNEO : SmartContract | |||
{ | |||
private static readonly byte[] GasClaim = "AQzRMe3zyGS8W177xLJfewRRQZY2kddMun".ToScriptHash(); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Testnet address?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
yes, a template for someone can control the gas generated by NEO in CNEO contract.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Remember to change it before deploy on mainnet
foreach (var output in outputs) | ||
{ | ||
if (output.ScriptHash.AsBigInteger() == currentHash.AsBigInteger()) | ||
if (output.ScriptHash.AsBigInteger() == currentHash.AsBigInteger() && output.AssetId.AsBigInteger() == AssetId.AsBigInteger()) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
这里应该检查所有的outputs,只有都满足条件才将 ifClaimGas 设置为 false;否则一个output满足就可以绕过这个检查,并没修复那个漏洞。
也许可以改为:
bool ifClaimGas = false;
foreach (var output in outputs)
{
if (output.ScriptHash.AsBigInteger() != currentHash.AsBigInteger() || output.AssetId.AsBigInteger() != AssetId.AsBigInteger())
ifClaimGas = true;
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
output.ScriptHash.AsBigInteger() != currentHash.AsBigInteger()
检查所有output的话, 比如这个判断条件会给管理员通过走ClaimGas的条件, 取走所有neo的权限
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
那现在这样其它人也能提GAS吧(貌似)
如果这么改呢:
if((byte)tx.Type == 0x02)
{
return inputs == null ? Runtime.CheckWitness(GasClaim) : false;
}
No description provided.