8000 impr(erc20): Add Informal Audit IF-ETHERMINT-06 protection by danburck · Pull Request #191 · evmos/evmos · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

impr(erc20): Add Informal Audit IF-ETHERMINT-06 protection #191

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 4 commits into from
Jan 4, 2022
Merged

impr(erc20): Add Informal Audit IF-ETHERMINT-06 protection #191

merged 4 commits into from
Jan 4, 2022

Conversation

danburck
Copy link
Contributor
@danburck danburck commented Jan 4, 2022 •
edited
Loading

Description

Closes: https://linear.app/tharsis/issue/ENG-376/if-ethermint-06-direct-balance-manipulation

This PR adds account balance checks for the coin and token conversions in order to prevent malicious contracts to change the balances differently than expected.

@linear
Copy link
linear bot commented Jan 4, 2022
ENG-376 IF-ETHERMINT-06: Direct balance manipulation

  • Add a check that the expected balances after executing transfer match the actual balances via runtime monitoring
  • Update spec invariants

@danburck danburck marked this pull request as ready for review January 4, 2022 11:05
@codecov
Copy link
codecov bot commented Jan 4, 2022 •
edited
Loading

Codecov Report

Merging #191 (d69e1e0) into main (71c4413) will decrease coverage by 1.91%.
The diff coverage is 43.67%.

❗ Current head d69e1e0 differs from pull request most recent head 53892a1. Consider uploading reports for the commit 53892a1 to get more accurate results
Impacted file tree graph

@@            Coverage Diff             @@
##             main     #191      +/-   ##
==========================================
- Coverage   72.78%   70.86%   -1.92%     
==========================================
  Files          33       32       -1     
  Lines        2065     2063       -2     
==========================================
- Hits         1503     1462      -41     
- Misses        499      529      +30     
- Partials       63       72       +9
Impacted Files Coverage Δ
x/erc20/keeper/keeper.go 100.00% <ø> (ø)
x/erc20/keeper/msg_server.go 68.49% <38.75%> (-13.28%) ⬇️
app/app.go 80.58% <100.00%> (-0.09%) ⬇️
x/erc20/types/params.go 100.00% <100.00%> (ø)

fedekunze
fedekunze reviewed Jan 4, 2022
View reviewed changes
Copy link
Collaborator
@fedekunze fedekunze left a comment •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Few changes requested. Also if you can update the function's comments and spec to reflect the new checks 🙏

@github-actions github-actions bot added the docs label Jan 4, 2022
fedekunze
fedekunze approved these changes Jan 4, 2022
View reviewed changes
Copy link
Collaborator
@fedekunze fedekunze left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ACK pending changelog entry 👍

@danburck danburck enabled auto-merge (squash) January 4, 2022 13:37
@danburck danburck merged commit f2dec8e into main Jan 4, 2022
@danburck danburck deleted the ENG-376-Direct-balance-manipulation branch January 4, 2022 13:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@fedekunze fedekunze fedekunze approved these changes

@jolube jolube Awaiting requested review from jolube

@khoslaventures khoslaventures Awaiting requested review from khoslaventures

Assignees
No one assigned
Labels
docs
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@danburck @fedekunze
0