diff --git a/ibc.chain/include/ibc.chain/ibc.chain.hpp b/ibc.chain/include/ibc.chain/ibc.chain.hpp index ad67605..ea0b916 100644 --- a/ibc.chain/include/ibc.chain/ibc.chain.hpp +++ b/ibc.chain/include/ibc.chain/ibc.chain.hpp @@ -168,10 +168,14 @@ namespace eosio { eosio_assert( is_equal_capi_checksum256( bhs.header.transaction_mroot, transaction_mroot ), "provided transaction_mroot not correct"); } - static bool is_relay( name ibc_contract_account, name check ) { - relays _relays( ibc_contract_account, ibc_contract_account.value ); - auto it = _relays.find( check.value ); - return it != _relays.end(); + static void require_relay_auth( name ibc_contract_account, name relay ) { + if ( check_relay_auth ) { + relays _relays( ibc_contract_account, ibc_contract_account.value ); + auto it = _relays.find( relay.value ); + return it != _relays.end(); + eosio_assert( it != _relays.end(), "this account is not registered as relay"); + require_auth( relay ); + } } // this action maybe needed when repairing the ibc system manually @@ -205,8 +209,6 @@ namespace eosio { capi_public_key get_public_key_form_signature( digest_type digest, signature_type sig ) const; bool only_one_eosio_bp(); - - void require_relay_auth( const name& relay ); }; } /// namespace eosio diff --git a/ibc.chain/src/ibc.chain.cpp b/ibc.chain/src/ibc.chain.cpp index c8fe261..e574fa2 100644 --- a/ibc.chain/src/ibc.chain.cpp +++ b/ibc.chain/src/ibc.chain.cpp @@ -53,7 +53,7 @@ namespace eosio { _prodsches.begin() == _prodsches.end() && _sections.begin() == _sections.end() && _gmutable.last_anchor_block_num == 0, "the light client has already been initialized" ); - require_relay_auth( relay ); + require_relay_auth( _self, relay ); } const signed_block_header& header = unpack( header_data ); @@ -109,7 +109,7 @@ namespace eosio { void chain::pushsection( const std::vector& headers_data, const incremental_merkle& blockroot_merkle, const name& relay ) { - require_relay_auth( relay ); + require_relay_auth( _self, relay ); eosio_assert( _gstate.consensus_algo == "pipeline"_n, "consensus algorithm must be pipeline"); @@ -433,7 +433,7 @@ namespace eosio { static const uint32_t max_delete = 150; // max delete 150 records per time, in order to avoid exceed cpu limit void chain::rmfirstsctn( const name& relay ){ - require_relay_auth( relay ); + require_relay_auth( _self, relay ); auto it = _sections.begin(); auto next = ++it; @@ -577,7 +577,7 @@ namespace eosio { const std::vector& proof_data, const name& proof_type, const name& relay ) { - require_relay_auth( relay ); + require_relay_auth( _self, relay ); eosio_assert( _gstate.consensus_algo == "batch"_n, "consensus algorithm must be batch"); eosio_assert( _chaindb.begin() != _chaindb.end(), "the light client has not been initialized yet"); @@ -887,12 +887,6 @@ namespace eosio { eosio_assert(false,"unknown action"); } - void chain::require_relay_auth( const name& relay ){ - if ( check_relay_auth ) { - require_auth( relay ); - } - } - } /// namespace eosio EOSIO_DISPATCH( eosio::chain, (setglobal)(chaininit)(pushsection)(rmfirstsctn)(pushblkcmits)(forceinit)(relay) ) diff --git a/ibc.token/include/ibc.token/ibc.token.hpp b/ibc.token/include/ibc.token/ibc.token.hpp index f080d2f..0dd3e21 100644 --- a/ibc.token/include/ibc.token/ibc.token.hpp +++ b/ibc.token/include/ibc.token/ibc.token.hpp @@ -41,10 +41,11 @@ namespace eosio { name to; asset quantity; string memo; + name relay; EOSLIB_SERIALIZE( cash_action_type, (seq_num)(from_chain)(orig_trx_id)(orig_trx_packed_trx_receipt) (orig_trx_merkle_path)(orig_trx_block_num)(orig_trx_block_header_data) - (orig_trx_block_id_merkle_path)(anchor_block_num)(to)(quantity)(memo) ) + (orig_trx_block_id_merkle_path)(anchor_block_num)(to)(quantity)(memo)(relay) ) }; const static uint32_t default_max_trxs_per_minute_per_token = 100; @@ -160,7 +161,8 @@ namespace eosio { const uint32_t& anchor_block_num, const name& to, // redundant, facilitate indexing and checking const asset& quantity, // redundant, facilitate indexing and checking - const string& memo ); + const string& memo, + const name& relay ); // called by ibc plugin [[eosio::action]] @@ -176,11 +178,11 @@ namespace eosio { // called by ibc plugin repeatedly [[eosio::action]] - void rollback( name peerchain_name, const transaction_id_type trx_id ); // check if any orignal transactions should be rollback, rollback them if have + void rollback( name peerchain_name, const transaction_id_type trx_id, name relay ); // check if any orignal transactions should be rollback, rollback them if have // called by ibc plugin repeatedly when there are unrollbackable original transactions [[eosio::action]] - void rmunablerb( name peerchain_name, const transaction_id_type trx_id ); // force to remove unrollbackable transaction + void rmunablerb( name peerchain_name, const transaction_id_type trx_id, name relay ); // force to remove unrollbackable transaction // this action maybe needed when repairing the ibc system manually [[eosio::action]] diff --git a/ibc.token/src/ibc.token.cpp b/ibc.token/src/ibc.token.cpp index 8cfe473..4a3b631 100644 --- a/ibc.token/src/ibc.token.cpp +++ b/ibc.token/src/ibc.token.cpp @@ -702,7 +702,11 @@ namespace eosio { const uint32_t& anchor_block_num, const name& to, // redundant, facilitate indexing and checking const asset& quantity, // with the token symbol of the original trx it self. redundant, facilitate indexing and checking - const string& memo ) { + const string& memo, + const name& relay ) { + auto pch = _peerchains.get( from_chain.value, "from_chain not registered"); + chain::require_relay_auth( pch.thischain_ibc_chain_contract, relay ); + // check global state eosio_assert( _gstate.active, "global not active" ); @@ -727,7 +731,7 @@ namespace eosio { action actn = trxn.actions.front(); transfer_action_type args = unpack( actn.data ); - auto pch = _peerchains.get( from_chain.value, "from_chain not registered"); + // check action parameters eosio_assert( args.to == pch.peerchain_ibc_token_contract, "transfer to account not correct" ); eosio_assert( args.quantity == quantity, "quantity not equal to quantity within packed transaction" ); memo_info_type memo_info = get_memo_info( args.memo ); @@ -911,7 +915,10 @@ namespace eosio { }); } - void token::rollback( name peerchain_name, const transaction_id_type trx_id ){ // notes: if non-rollbackable attacks occurred, such records need to be deleted manually, to prevent RAM consume from being maliciously occupied + void token::rollback( name peerchain_name, const transaction_id_type trx_id, name relay ){ // notes: if non-rollbackable attacks occurred, such records need to be deleted manually, to prevent RAM consume from being maliciously occupied + auto pch = _peerchains.get( peerchain_name.value ); + chain::require_relay_auth( pch.thischain_ibc_chain_contract, relay ); + auto _origtrxs = origtrxs_table( _self, peerchain_name.value ); auto idx = _origtrxs.get_index<"trxid"_n>(); auto it = idx.find( fixed_bytes<32>(trx_id.hash) ); @@ -923,8 +930,6 @@ namespace eosio { string memo = "rollback transaction: " + capi_checksum256_to_string(trx_id); print( memo.c_str() ); - auto pch = _peerchains.get( peerchain_name.value ); - if ( action_info.contract != _self ){ // rollback ibc transfer const auto& acpt = get_currency_accept( action_info.contract ); _accepts.modify( acpt, same_payer, [&]( auto& r ) { @@ -972,7 +977,10 @@ namespace eosio { } static const uint32_t min_distance = 3600 * 24 * 2; // one day - void token::rmunablerb( name peerchain_name, const transaction_id_type trx_id ){ + void token::rmunablerb( name peerchain_name, const transaction_id_type trx_id, name relay ){ + auto pch = _peerchains.get( peerchain_name.value ); + chain::require_relay_auth( pch.thischain_ibc_chain_contract, relay ); + auto _origtrxs = origtrxs_table( _self, peerchain_name.value ); auto idx = _origtrxs.get_index<"trxid"_n>(); auto it = idx.find( fixed_bytes<32>(trx_id.hash) );