Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[N01] Lack of input validation #6989

Merged
merged 6 commits into from
Feb 16, 2021
Merged

[N01] Lack of input validation #6989

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
29b0208
Validate spender addresses
martinvol Feb 9, 2021
f4c1b19
Clean up
martinvol Feb 10, 2021
56a675c
Merge branch 'release/celo-core-contracts/3' into martinvol/validateS…
martinvol Feb 15, 2021
76dfbbf
Merge branch 'release/celo-core-contracts/3' into martinvol/validateS…
martinvol Feb 16, 2021
6882bc2
Merge branch 'release/celo-core-contracts/3' into martinvol/validateS…
martinvol Feb 16, 2021
807928e
Merge branch 'release/celo-core-contracts/3' into martinvol/validateS…
martinvol Feb 16, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions packages/protocol/contracts/stability/Reserve.sol
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -298,6 +298,7 @@ contract Reserve is
* @param spender The address that is allowed to spend Reserve funds.
*/
function addSpender(address spender) external onlyOwner {
require(address(0) != spender, "Spender can't be null");
isSpender[spender] = true;
emit SpenderAdded(spender);
}
Expand Down Expand Up @@ -325,6 +326,7 @@ contract Reserve is
* @param spender The address that is allowed to spend Reserve funds.
*/
function addExchangeSpender(address spender) external onlyOwner {
require(address(0) != spender, "Spender can't be null");
require(!isExchangeSpender[spender], "Address is already Exchange Spender");
isExchangeSpender[spender] = true;
exchangeSpenderAddresses.push(spender);
Expand Down
12 changes: 10 additions & 2 deletions packages/protocol/test/stability/reserve.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -303,6 +303,10 @@ contract('Reserve', (accounts: string[]) => {
})
})

it('does not allow an empty address', async () => {
await assertRevert(reserve.addExchangeSpender('0x0000000000000000000000000000000000000000'))
})

it('has the right list of exchange spenders after addition', async () => {
await reserve.addExchangeSpender(exchangeAddress)
await reserve.addExchangeSpender(accounts[1])
Expand Down Expand Up @@ -373,13 +377,17 @@ contract('Reserve', (accounts: string[]) => {
it('emits on add', async () => {
const addSpenderTx = await reserve.addSpender(spender)

const addExchangeSpenderTxLogs = addSpenderTx.logs.filter((x) => x.event === 'SpenderAdded')
assert(addExchangeSpenderTxLogs.length === 1, 'Did not receive event')
const addSpenderTxLogs = addSpenderTx.logs.filter((x) => x.event === 'SpenderAdded')
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this was a typo

assert(addSpenderTxLogs.length === 1, 'Did not receive event')
})

it('only allows owner', async () => {
await assertRevert(reserve.addSpender(nonOwner, { from: nonOwner }))
})

it('does not allow an empty address', async () => {
await assertRevert(reserve.addSpender('0x0000000000000000000000000000000000000000'))
})
})

describe('#removeSpender(spender)', () => {
Expand Down