v0.7.3

Security release for stellar-accounts. It fixes GHSA-jpg9-m7w4-c7wc: a Signer::Delegated signer could authorize a smart account without any signature. This happened when the delegated address was the contract requesting the account's authorization, or when delegation looped back to the account (self, mutual, or a chain into a mutual pair). All users of stellar-accounts < 0.7.3 should upgrade and redeploy or upgrade their smart account contracts.

Changes

• do_check_auth rejects a Delegated(addr) signer when addr is the contract of any context being authorized, via the new public validate_no_delegated_context_contract (SmartAccountError::DelegatedSignerIsContextContract, error #3017).
• add_context_rule, add_signer and batch_add_signer reject a Delegated signer pointing to the smart account itself, via the new public validate_no_self_delegation (SmartAccountError::SelfDelegatedSigner, error #3018).

Behavior changes

• A contract listed as a Delegated signer can no longer authorize the account just by calling require_auth() on it. It now fails with #3017. The delegate must authenticate against the operation digest through its own __check_auth.
• A custom __check_auth that calls authenticate directly, instead of do_check_auth, must call validate_no_delegated_context_contract first.

Notes

• The check runs in the account that authorizes back, so an account is protected only when the accounts it delegates to are also upgraded.
• A Delegated signer must not be an account that delegates its authentication back to the smart account (for example through CAP-71 delegate_auth), unless that account authenticates through do_check_auth. See the Security Warning on validate_no_delegated_context_contract.

Full Changelog: v0.7.2...v0.7.3