npm/tic-traction
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

ActionTransfer: 必须检查发起人地址和公钥是匹配的，否则客户端能够造假

Browse Source
This commit is contained in:
陆柯 2020-02-27 20:02:35 +08:00
parent bbb573c3a8
commit 61318e8940
2 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
Action.js
View File

@ -126,6 +126,7 @@ DAD._initTypeDict = function(typedActionDict) {
DAD.build = async function (action, keypair) { // Applicable on client. 客户端调用 Action.build，即可新建、并打包成一个完整的子事务，不需要亲自调用 constructor, packMe 等方法。 DAD.build = async function (action, keypair) { // Applicable on client. 客户端调用 Action.build，即可新建、并打包成一个完整的子事务，不需要亲自调用 constructor, packMe 等方法。
if (action && action.type && keypair && keypair.seckey && keypair.pubkey) { if (action && action.type && keypair && keypair.seckey && keypair.pubkey) {
let typedAction = new wo[action.type](action) let typedAction = new wo[action.type](action)
typedAction.actorPubkey = keypair.pubkey
if (typedAction.validateMe()) { if (typedAction.validateMe()) {
await typedAction.packMe(keypair) await typedAction.packMe(keypair)
return typedAction return typedAction

7
ActionTransfer.js
View File

@ -1,4 +1,5 @@
const Action = require('./Action.js') const Action = require('./Action.js')
const ticCrypto = require('tic.crypto')
const DAD = module.exports = function ActionTransfer (prop) { const DAD = module.exports = function ActionTransfer (prop) {
this._class = this.constructor.name this._class = this.constructor.name
@ -12,8 +13,10 @@ MOM.__proto__ = Action.prototype
MOM.validateMe = function () { MOM.validateMe = function () {
// if (sender && sender.type !== 'multisig' && action.toAddress != action.actorAddress && sender.balance >= action.amount + action.fee){ // if (sender && sender.type !== 'multisig' && action.toAddress != action.actorAddress && sender.balance >= action.amount + action.fee){
return this.actorAddress && this.toAddress && this.toAddress != this.actorAddress return this.actorAddress && this.actorPubkey && ticCrypto.pubkey2address(this.actorPubkey)=== this.actorAddress // 必须检查发起人地址和公钥是匹配的，否则客户端能够造假
&& this.amount && this.amount > 0 && (this.fee >= wo.Config.MIN_FEE_ActionTransfer || 0) && this.toAddress && this.toAddress != this.actorAddress
&& this.amount && this.amount > 0 && (this.fee >= 0)
} }
MOM.executableMe = async function() { MOM.executableMe = async function() {