chore: production release (missing tests) #21
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
separating #13 into different PRs/commits fixing the time-deltas to be the updated (shorter) ones: 3, 6, 9, 12 months
Fixes HAL-003 > ## Description > In order to participate in a token locking process, a user needs to first invoke the process_init entry point. > > This entry point will create an account with the necessary size to store the information provided in the next step of the process, process_create . > > The current version of this program is not checking that the provided System Program and Rent Sysvar accounts corresponds to the correct accounts, provided by the Solana Rust SDK. > > Although there was not risk identified due to this lack of restrictions, it is a good practice to implement this validations to prevent any unexpected attack vector that might appear later.
Fixes HAL-002 > ## Description > After the user invokes the process_init entry point, they need to invoke the process_create entry point to store the necessary information to participate in the token locking process. > > A piece of information that the user has to provide is the source token account, where the tokens will be subtracted to participate. > > The mentioned token account is not validated to be a token account corresponding to the L3 token, which is expected to be the token used. > > As a result, any user can create a vesting_account that does with any token different than L3 token. > > The L3 team mentioned that this situation does not represent a risk, since the information on chain will be used on an off-chain process. > > However, it is considered a good practice to restrict the functionalities of a program used in production to narrow down the attack surface in order to prevent unexpected behaviors.
wei3erHase
changed the title
0xGorilla
approved these changes
Oct 9, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
No description provided.