minime icon indicating copy to clipboard operation
minime copied to clipboard

Cloned token state is not locked when cloned with current or future block number

Open rudolfix opened this issue 7 years ago • 0 comments

When token is cloned at block number that is current block (the default option) in createCloneToken

if (_snapshotBlock == 0) _snapshotBlock = block.number;

or with future block number, it should not be possible to change state (that is balances and total supply) of the cloned token. Allowing that will easily lead to inconsistencies when state changes in cloned token partially "shadow" changes in parent. Example

we are at block 100, parent token state is {owner1 balance: 100, owner2 balance :10, totalSupply:110}, token is cloned at block 110.

at block 110 two operations happen clone.destroyTokens(owner1, 1) parent.transfer(owner2, 10, {from: owner1}

which will result in following state of cloned token (at block 110 and future blocks) owner1 balance: 99 (shadows parent token) owner2 balance: 20 (taken from parent token as there is no value stored for owner2 in the clone) totalSupply: 109 (shadows parent token)

at this point balances sum to 119 but totalSupply is 109

solution would be to revert on any calls to destroyTokens and generateTokens that happen before and at the block at which clone is created as doTransfer function already does.

changing the default clone _snapshotBlock to

if (_snapshotBlock == 0) _snapshotBlock = block.number - 1;

would also be advisable as parent state at block.number - 1 is already immutable. cloning at current block is basically cloning at unknown parent state (which may be changed before but also after the clone transaction)

rudolfix avatar Oct 27 '17 16:10 rudolfix