joshua | Flow (2024-07-09)
I'm looking to add some pre and post conditions to the generic FT and NFT transactions that we include in Ledger and encourage other projects to use to make them safer. Anyone have any suggestions for what we can include besides what I have listed in the issues?
https://github.com/onflow/flow-ft/issues/162
https://github.com/onflow/flow-nft/issues/222
17 Replies
I've created a thread for your message. Please continue any relevant discussion in this thread.
You can rename this thread using
/title <new title>
If this is a technical question that others may benefit from, considering also asking it on Stackoverflow: https://stackoverflow.com/questions/ask?tags=onflow-cadence@Giovanni S
Unknown Userβ’3mo ago
Message Not Public
Sign In & Join Server To View
assertions too
Unknown Userβ’3mo ago
Message Not Public
Sign In & Join Server To View
mostly assertions right now actually
Unknown Userβ’3mo ago
Message Not Public
Sign In & Join Server To View
For this transaction specifically: https://github.com/onflow/flow-ft/blob/master/transactions/generic_transfer_with_address.cdc
I am thinking of the scenario when a malicious contract updates their FTVaultData view and createEmptyVault functions to return vaults and information for FlowToken, so that if someone said they wanted to transfer that contract's vault the view would instead make them transfer FlowToken instead. How can we prevent that with assertions?
maybe doing a getType and checking that the identifier contains the address and contract name? Is there a
contains
function for String
? Or some other way to do that?Unknown Userβ’3mo ago
Message Not Public
Sign In & Join Server To View
Oh shoot I meant to add those to the ft/nft repos π€¦ββοΈ sorry for missing that
Unknown Userβ’3mo ago
Message Not Public
Sign In & Join Server To View
Good callout on malicious contract π€ If there's flexibility around txn params, maybe we could instead take either a vault type or identifier and extract the contract name & address from that (ideally we could just do something like
type.definingContract as! &{ViewResolver}
but that's a new Cadence feature)
Then from that param, include a pre-condition that the tempVault type/identifier matches the one providedI'm using this right now and it works. π
ugly though
tbh this boilerplate could probably live in a utils contract
I can see it being more widely used given the push toward generic txns. not sure where to put it though
Unknown Userβ’3mo ago
Message Not Public
Sign In & Join Server To View