Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix review - require funder equals issuer #116

Merged
merged 37 commits into from
Feb 28, 2023
Merged

Fix review - require funder equals issuer #116

merged 37 commits into from
Feb 28, 2023

Conversation

FlacoJones
Copy link
Contributor

  • Adds the line require(msg.sender == bounty.issuer(), Errors.CALLER_NOT_ISSUER); to DepositManagerV1::fundBountyToken

NOTE: Since the bounty issuer is trusted and immutable, this converts would-be exploits of external users into user error of the issuer.

@FlacoJones
removes all traces of Ongoing and TieredPercentage bounties, includin…
2eb4bae 
…g the Ongoing+TieredPercentage implementations, interfaces, and methods in OpenQV1 and ClaimManagerV1
@FlacoJones
updates BountyFactory test to operate without Ongoing or TieredPercen…
5206d9a 
…tage
@FlacoJones
updates ClaimManager tests to pass without Ongoing or TieredPercentage
67155c2
@FlacoJones
updates DepositManager test to run without Ongoing or TieredPercentag…
9c56e95 
…e bounty types
@FlacoJones
updates OpenQ test to pass without Ongoing or TieredPercentage bounty…
71ed979 
… types
@FlacoJones
udpates TieredBountyCore tests to pass without Ongoing or TieredPerce…
4300bae 
…ntage
@FlacoJones
updates deploy scripts to operate without Ongoing or TieredPercentage
6fb823c
@FlacoJones
removes TOKEN_ADDRESS_LIMIT from TokenWhitelist.sol
321c8d7
@FlacoJones
removes the check of token address limit on DepositManager. simply re…
834cdb8 
…quires token is whitelisted, or reverts
@FlacoJones
removes tokenAddressLimitReached in DepositManager
dc2364a
@FlacoJones
updates OpenQTokenWhitelist tests to pass without TOKEN_ADDRESS_LIMIT
5b11bb6
@FlacoJones
updates deploy script for OpenQTokenWhitelist being initialized witho…
29cb98e 
…ut a token address limit
@FlacoJones
removes deprecated tests in DepositManager.test.js related to TOKEN_A…
ea60cb4 
…DDRESS_LIMIT, simply checks if token is whitelisted or not
@FlacoJones
updates OpenQ.test.js to deploy OpenQTokenWhitelist without TOKEN_ADD…
9bde618 
…RESS_LIMIT in constructor
@FlacoJones
further updates tests to deploy OpenQTokenWhitelist without TOKEN_ADD…
b32f0b2 
…RESS_LIMIT in the constructor
@FlacoJones
removes nft logic from AtomicBountyV1.sol
3630be4
@FlacoJones
removes nft logic from BountyCore.sol
f67a4ca
@FlacoJones
removes NFT logic from TieredBountyCore
fd0fae1
@FlacoJones
removes nftDepositLimit from TieredFixedBountyV1.sol
d7845b6
@FlacoJones
removes nft interface methods from IBountyCore.sol
89d6386
@FlacoJones
removes logic that looped over nft deposits to transfer on claims
cb23808
@FlacoJones
removes nft funding logic from DepositManagerV1
b25f6a6
@FlacoJones
removes unused NFT related error messages from Errors.sol
69fdb97
@FlacoJones
removes MockNFT contract
3dd7ae2
@FlacoJones
updates DepositManager.test.js to remove nft related tests
3d7f4f5
@FlacoJones
removes nft related tests from ClaimManager.test.js
01d67be
@FlacoJones
removes nft related tests from OpenQ.test.js
f7db4c9
@FlacoJones
updates deploy contract script to remove nft related logic
983c1c4
@FlacoJones
removes MockNFt from fund_bounties script
b6767a8
@FlacoJones
removes nft logic from AtomicBountyV1.test.js
54a4500
@FlacoJones FlacoJones changed the title Fix review require funder equals issuer Fix review - require funder equals issuer Feb 26, 2023
This was referenced Feb 26, 2023
Closed
Closed
Closed
Open
Closed
Closed
Closed
Open
Open
Open
Closed
Closed
Closed
Closed
Closed
Closed
Open
Closed
Open
Open
Closed
IAm0x52
IAm0x52 approved these changes Feb 28, 2023
View reviewed changes
Copy link

@IAm0x52 IAm0x52 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Changes look good. Requires that funder is the issuer. This prevents a whole host of potential exploits in exchange for closing the otherwise open funding model.

@FlacoJones FlacoJones merged commit 8a700e8 into audit Feb 28, 2023
@FlacoJones FlacoJones deleted the fix-review-require-funder-equals-issuer branch August 10, 2023 02:30
@FlacoJones FlacoJones restored the fix-review-require-funder-equals-issuer branch August 10, 2023 02:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@IAm0x52 IAm0x52 IAm0x52 approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@FlacoJones @IAm0x52