Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Feature]: add authz MsgRevokeAll message #20139

Closed
arlai-mk opened this issue Apr 22, 2024 · 2 comments · Fixed by #20161
Closed

[Feature]: add authz MsgRevokeAll message #20139

arlai-mk opened this issue Apr 22, 2024 · 2 comments · Fixed by #20161

Comments

@arlai-mk
Copy link
Contributor

arlai-mk commented Apr 22, 2024

Summary

The authz module currently requires a user to revoke grants one by one, providing the grant message, the grantee, and the granter.
There is no option to revoke all grants at once, which could be useful in case of a wallet compromise.

I would like to suggest adding a MsgRevokeAll message for this purpose.

Problem Definition

This idea come from a case that I've been asked to investigate, where an attacker, right after enticing his victim to sign a MsgGrant authorization, created grants for 2000 other addresses under its control (one example tx: https://www.mintscan.io/cosmos/tx/5C21BC64CF0FF8502DCF1DD623973FDB939B3519259881135E5861CC5BA16157?height=19607416).

As revoking grants needs to be done one grant at a time (you need a UI to list them and then revoke them all), it makes it impossible to protect yourself after authorizations have been granted to 2000 addresses.

This has already been discussed in this thread, now creating a separate issue on @julienrbrt advice.

Proposed Feature

The MsgRevokeAll message would loop through all grants from a specific granter and Delete them all.

@kien6034
Copy link
Contributor

hi guys, can I work on this issue?

@julienrbrt
Copy link
Member

Yes, thank you!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants