search

Agoric / dapp-agoric-basics

This is a simple app for the Agoric smart contract platform.
0 stars 4 forks source link

postal service limited to issuers from startInstance #46

Closed dckc closed 6 months ago

dckc commented 6 months ago

the postal service contract doesn't dynamically add issuers like the swaparoo contract does.

noted by @samsiegart in #45

Design

let clients give issuers to add in the invitationArgs

dckc commented 6 months ago

I'm not sure about the security implications of letting clients unilaterally add issuers. Added needs-design.

samsiegart commented 6 months ago

Thanks for making an issue.

I'm not sure about the security implications of letting clients unilaterally add issuers. Added needs-design.

If the design was up to me right now, I'd just allow it. We already do the same with swaparoo. If we ever decide to deploy this to mainnet, perhaps we could revisit these concerns?

dckc commented 6 months ago

I suppose as long as the clients don't get to choose names / keywords, it should be fine.

https://github.com/Agoric/dapp-agoric-basics/blob/8d801d92bbed67926645a6738c25156cd08b2973/contract/src/swaparoo.contract.js#L199

So the design would be, like swaparoo, to let clients give issuers to add in the invitationArgs? (or offerArgs)

samsiegart commented 6 months ago

So the design would be, like swaparoo, to let clients give issuers to add in the invitationArgs? (or offerArgs)

Yea, in invitationArgs