HydraDX-node icon indicating copy to clipboard operation
HydraDX-node copied to clipboard

Bug: missing validation when `set_currency` used in a batch

Open dmoka opened this issue 4 months ago • 0 comments

Description

When we use utility.batch and have set_currency as first extrinsic, then we don't do any validation for the specified currrency.

It can lead to problem like:

Eg. the old DAI token with id 2. There seems be still some of it in our chain ( at least issuance shows something )
if you try to set currency to 2 - it would fail, because it is not accepted
however, if you use set currency as first tx in batch, and set it to 2 -> this would work, because there is old old price from oracle ( from block 2,188,027 ).
so you could pay with this asset.

Problematic code: https://github.com/galacticcouncil/hydration-node/blob/c048260d51d6c6b9ed49a4bee3bdfdda5c083070/pallets/transaction-multi-payment/src/lib.rs#L655

Solution

We could use the same check we have in set currency extrinsic, so check if it is in accepted currencies or has XYK DOT pool. Probably, we should use the same function.

dmoka avatar Sep 30 '24 05:09 dmoka