Merge branch 'master' into df-naming-conventions

contracts/Accounts.sol

@@ -113,15 +113,14 @@ contract Accounts is Data {
         external
         onlyAccountOwner(accountId)
     {
-        address addr = accounts[accountId].owner;
         uint64 balance = accounts[accountId].balance;
 
         require(balance >= amount, "insufficient funds");
         require(amount > 0, "amount should be nonzero");
 
         balanceSub(accountId, amount);
 
-        token.transfer(addr, amount);
+        require(token.transfer(msg.sender, amount), "transfer failed");
     }
 
     /**
@@ -135,7 +134,6 @@ contract Accounts is Data {
     function deposit(uint64 amount, uint256 accountId) external {
         require(accountId < accounts.length || accountId == NEW_ACCOUNT_FLAG, "invalid accountId");
         require(amount > 0, "amount should be positive");
-        require(token.transferFrom(msg.sender, address(this), amount), "transfer failed");
 
         if (accountId == NEW_ACCOUNT_FLAG) {
             // new account
@@ -145,6 +143,8 @@ contract Accounts is Data {
             // existing account
             balanceAdd(accountId, amount);
         }
+
+        require(token.transferFrom(msg.sender, address(this), amount), "transfer failed");
     }
 
     /**

package.json

@@ -37,7 +37,7 @@
     "istanbul": "^0.4.5",
     "solhint": "^2.0.0",
     "standard": "^12.0.1",
-    "truffle-hdwallet-provider": "^1.0.6"
+    "truffle-hdwallet-provider": "1.0.6"
   },
   "standard": {
     "globals": [

test/test_accounts.js

@@ -101,6 +101,17 @@ contract('Accounts', (addr) => {
       assert.equal(y1 - y0, amount / 2)
     })
 
+    it('Should reject withdrawals for existing accounts when sender is not the owner', async () => {
+      const amount = 100
+
+      await st.approve(bp.address, amount)
+      await bp.deposit(amount, newAccountFlag)
+      let id = await bp.getAccountsLength.call()
+      id = id.toNumber() - 1
+
+      await catchRevert(bp.withdraw(amount / 2, id, { from: a1 }))
+    })
+
     it('Should reject withdrawals for invalid accounts', async () => {
       const amount = 100