fix: losing profile on impersonation threat #42
Conversation
If the impersonated requests transferring her profile to the foreign chain, her profile will be removed as a consequence of the unsatisfied conditions on ccGrantHumanity. This update allows avoiding such unwanted side effect if the mentioned edgecase occurs.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| @@ -287,6 +297,16 @@ | |||
|
|
|||
| // ========== RECEIVES ========== | |||
|
|
|||
| function checkCCTransferCondition( | |||
| address _owner, | |||
Check warning
Code scanning / Slither
Conformance to Solidity naming conventions Warning
| @@ -287,6 +297,16 @@ | |||
|
|
|||
| // ========== RECEIVES ========== | |||
|
|
|||
| function checkCCTransferCondition( | |||
| address _owner, | |||
| bytes20 _humanityId | |||
Check warning
Code scanning / Slither
Conformance to Solidity naming conventions Warning
| @@ -366,7 +386,7 @@ | |||
| * @param _humanityId The id of the humanity to check | |||
| * @return Whether humanity is claimed | |||
| */ | |||
| function isClaimed(bytes20 _humanityId) external view returns (bool) { | |||
| function isClaimed(bytes20 _humanityId) public view returns (bool) { | |||
Check warning
Code scanning / Slither
Conformance to Solidity naming conventions Warning
| function ccIsHumanityGranteable( | ||
| bytes20 _humanityId, | ||
| address _account | ||
| ) external view onlyCrossChain returns (bool success) { | ||
| Humanity storage humanity = humanityData[_humanityId]; | ||
|
|
||
| // If humanity is claimed, don't overwrite. | ||
| if (humanity.owner != address(0x0) && block.timestamp < humanity.expirationTime) return false; | ||
|
|
||
| // Must not be in the process of claiming a humanity. | ||
| require(humanityData[accountHumanity[_account]].requestCount[_account] == 0); | ||
| return true; | ||
| } |
Check notice
Code scanning / Slither
Block timestamp Low
| @@ -484,6 +484,20 @@ | |||
|
|
|||
| /// ====== GOVERNANCE ====== /// | |||
|
|
|||
| function ccIsHumanityGranteable( | |||
| bytes20 _humanityId, | |||
Check warning
Code scanning / Slither
Conformance to Solidity naming conventions Warning
| function ccIsHumanityGranteable( | ||
| bytes20 _humanityId, | ||
| address _account | ||
| ) external view onlyCrossChain returns (bool success) { | ||
| Humanity storage humanity = humanityData[_humanityId]; | ||
|
|
||
| // If humanity is claimed, don't overwrite. | ||
| if ( | ||
| (humanity.owner != address(0x0) && block.timestamp < humanity.expirationTime) || | ||
| // If not claimed in this contract, check in fork module too. | ||
| forkModule.isRegistered(_account) | ||
| ) return false; | ||
|
|
||
| // Must not be in the process of claiming a humanity. | ||
| require(humanityData[accountHumanity[_account]].requestCount[_account] == 0); | ||
| } |
Check notice
Code scanning / Slither
Block timestamp Low
| @@ -487,6 +487,23 @@ | |||
|
|
|||
| /// ====== GOVERNANCE ====== /// | |||
|
|
|||
| function ccIsHumanityGranteable( | |||
| bytes20 _humanityId, | |||
Check warning
Code scanning / Slither
Conformance to Solidity naming conventions Warning
| @@ -487,6 +487,23 @@ | |||
|
|
|||
| /// ====== GOVERNANCE ====== /// | |||
|
|
|||
| function ccIsHumanityGranteable( | |||
| bytes20 _humanityId, | |||
| address _account | |||
Check warning
Code scanning / Slither
Conformance to Solidity naming conventions Warning
| function ccIsHumanityDischargeable( | ||
| address _account | ||
| ) external view onlyCrossChain returns (bytes20 humanityId, uint40 expirationTime) { | ||
| humanityId = accountHumanity[_account]; | ||
| Humanity storage humanity = humanityData[humanityId]; | ||
| require(humanity.nbPendingRequests == 0); | ||
|
|
||
| if (humanity.owner == _account && block.timestamp < humanity.expirationTime) { | ||
| require(!humanity.vouching); | ||
|
|
||
| expirationTime = humanity.expirationTime; | ||
|
|
||
| } else { | ||
| // V1 profiles have default humanity. | ||
| humanityId = bytes20(_account); | ||
|
|
||
| // Should revert in case account is not registered. | ||
| expirationTime = forkModule.tryRemove(_account); | ||
| } | ||
| } |
Check notice
Code scanning / Slither
Block timestamp Low
| @@ -526,6 +543,27 @@ | |||
| return true; | |||
| } | |||
|
|
|||
| function ccIsHumanityDischargeable( | |||
| address _account | |||
Check warning
Code scanning / Slither
Conformance to Solidity naming conventions Warning
If the impersonated requests transferring her profile to the foreign chain, her profile will be removed as a consequence of the unsatisfied conditions on ccGrantHumanity. This update allows avoiding such unwanted side effect if the mentioned edgecase occurs.