Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

TRST audit fixes for Graph Payments contracts #1072

Open
wants to merge 6 commits into
base: horizon
Choose a base branch
from

Conversation

tmigone
Copy link
Contributor

@tmigone tmigone commented Nov 26, 2024

This PR addresses the following audit findings:

  • TRST-H-1 A payer could bypass the escrow mechanism and avoid payments
  • TRST-M-10 A RAV could be collected more than once, leading to double payment
  • TRST-CL-1 A payer could bypass the escrow mechanism and avoid payments through the vulnerable collector allowance mapping
  • TTRST-L-10 The getBalance() function could revert when balance is lower than tokens thawing
  • TRST-M-5 Lack of chunking functionality of new RAVs may cause them to not be processable

Copy link

openzeppelin-code bot commented Nov 26, 2024

TRST audit fixes for Graph Payments contracts

Generated at commit: 670fba7cf1538e30a5b38465c51ed30402310e41

🚨 Report Summary

Severity Level Results
Contracts Critical
High
Medium
Low
Note
Total
2
4
0
15
40
61
Dependencies Critical
High
Medium
Low
Note
Total
0
0
0
0
0
0

For more details view the full report in OpenZeppelin Code Inspector

@tmigone tmigone force-pushed the tmigone/trust-fixes-payments branch 2 times, most recently from d705ca6 to 7d62913 Compare November 28, 2024 15:30
@tmigone tmigone changed the title TRST audit fixes for GraphPayments contracts TRST audit fixes for Graph Payments contracts Nov 28, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant