Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add extra deposit and withdraw methods #150
Add extra deposit and withdraw methods #150
Changes from 15 commits
5dc1d09
224ac5c
b937de7
5adcebe
6f41665
9ea2e59
a3c724d
b55241c
ca0f41c
9c7ec02
e9ed14a
e28a8a4
013258e
3fe1fe0
c2afea8
4163daf
7604c76
725b4b7
bbd76e1
1646095
4c7fc1e
File filter
Filter by extension
Conversations
Jump to
There are no files selected for viewing
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
You are using
let user_account = get_tx_info().unbox().account_contract_address;
here and inclose_position
, as opposed to usingget_caller_address()
inwithdraw
andextra_deposit
. I was wondering if there is a special reason for this?Ideally i think it should be replaced by
get_caller_address()
. You can read about the security implication at:https://github.com/starknet-edu/starknetbook/blob/8cfcd33ccd9afee425f31a10a721f20a84554ca5/src/ch02-14-security-considerations.md?plain=1#L150.
But in a nutshell, something like this could happen:
loop_liquidity
orclose_position
of Alice's Spotnet contractloop_liquidity
orclose_position
not necessarily knowing so.This is possible because you are checking the address of the tx's origin, not the caller address.
Granted this is not a big problem because Bob can't steal any money, but Bob might be able to cause Alice to lose money in certain cases, obviously. Probably some easiest way would be closing a premature position that hasn't profited or sending along a wrong price.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
There was an issue with testing. If there is a way we can bypass this behavior it would be great to use get_caller_address everywhere, but I didn't find any info on that. So get_caller_address is used when we are not swapping through Ekubo.