Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CW 1.0, User inputs must be deserialized into String, not Addr. #33

Closed
denismaxim0v opened this issue Sep 15, 2022 · 2 comments
Closed

Comments

@denismaxim0v
Copy link

denismaxim0v commented Sep 15, 2022

Currently this branch has the updated code that ports the implementation to cosmwasm 1.0, however the changes made seem to be wrong. Cosmwasm docs state:

The new type Addr was created to hold validated addresses. Those can be created via Addr::unchecked, Api::addr_validate, Api::addr_humanize and JSON deserialization. In order to maintain type safety, deserialization into Addr must only be done from trusted sources like a contract's state or a query response. User inputs must be deserialized into String.

Addr must not be used in messages sent by the user because this would result in unvalidated instances.

User inputs such as

TransferFrom {
        owner: Addr,
        recipient: Addr,
        amount: Uint128,
        memo: Option<String>,
        padding: Option<String>,
}

Should deserialize into strings instead of Addr and then validated using addr_validate. Please refer to the original cw20 implementation here

 TransferFrom {
        owner: String,
        recipient: String,
        amount: Uint128,
},
@toml01
Copy link
Member

toml01 commented Sep 15, 2022

Thanks @denismaxim0v you are correct.
Keep in mind that the V1 version of snip20 implementation is still WIP, so use at your own risk

cc @eladr7

@eladr7
Copy link
Contributor

eladr7 commented Sep 15, 2022

@denismaxim0v Thank you Denis.
I updated the PR accordingly.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants