pact icon indicating copy to clipboard operation
pact copied to clipboard

How can i check the module-name in gas-stations for cont type transactions?

Open bart-kuma opened this issue 3 years ago • 2 comments

I have implemented a gas-station for my project. When i tried to pay gas for a cont type txn, it threw an Inside an exec error.

(defcap GAS_PAYER:bool
    ( user:string
      limit:integer
      price:decimal
    )
    (enforce (= "exec" (at "tx-type" (read-msg))) "Inside an exec")
    (enforce (= 1 (length (at "exec-code" (read-msg)))) "Tx of only one pact function")
    (enforce (= "(free.anedak." (take 13 (at 0 (at "exec-code" (read-msg))))) "only free.anedak smart contract")
    (compose-capability (ALLOW_GAS))
  )

While looking at the code, I found that only exec type transactions are supported in most gas-stations and the condition to enforce that only my contract/namespace can use the gas-station is only possible in exec type txns. So, if i change the code to support cont type txns, i can't check the module name and my gas-station is vulnerable for attacks and spams.

The data to check module name and txn types are added in this block of code in chainweb-node. I don't think i can use any of the already available props to check the module name for cont type txns.

I found this gas-station code for cont type txns, but no checks on module name.

Any solutions on how i can check the module-name in cont type txns will be helpful.

I have also asked this question in SO.

bart-kuma avatar Dec 13 '22 05:12 bart-kuma

There is no support for this currently as the haskell code you referenced shows. We can add support for this in an upcoming chainweb release. @emilypi

sirlensalot avatar Dec 13 '22 16:12 sirlensalot

Good idea - we'll scope for the upcoming release.

emilypi avatar Dec 13 '22 17:12 emilypi