feat(vesting): support vesting account creation via new module x/vauth#144
Merged
Conversation
cbd3f3d to
a9536c6
Compare
VictorEscan
approved these changes
Sep 5, 2024
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes: #143
Problem:
Vesting account creation can select account to create vesting, this leading to security issue that attacker can create vesting account on future-contract-address therefore contract cannot be created.
This this why Evmos needs to implement a custom
x/vestingmodule and some chains need to disable this feature or implement a whitelist granter.Solution:
So the problem is how to prove that the grantee account is External Owned Account and if either (granter, grantee) can prove it, problem solved.
x/vauthis a new module added by this PR, based on Ethereum signed message.x/vauthtx.x/vauthmodule verify the signature and set flag**verified**for the address delivered from the signature (grantee).VestingMessagesAuthorizationDecoratorcheck if grantee has proved viax/vauthx/vauth, allow the message to pass throughSample CLI:
cc: @yihuang @omritoptix @fedekunze