search

Giveth / vaultcontroller

Vault Architecture
GNU General Public License v3.0
0 stars 3 forks source link

Bypassable limits #25

Open adria0 opened 7 years ago

adria0 commented 7 years ago

A malicius administrador is able to create n vaultcontroller childs under his control. Since each child has the same limits as the parent controller, the effective total limits for this malicius administrador is n*_dailyAmountLimit n*_dailyTxnLimit n*_txnAmountLimit

initializeChildVault should check that the sum of the limits for the current childres does not exceed the parent limits.

setChildVaultLimits/setVaultLimits should also propagate total limits.

jbaylina commented 7 years ago

Each vault has his limits. But we need to talk about this..

GriffGreen commented 7 years ago

That is a very interesting potential scam.

I think there should be a daily limit on topUpVault()to prevent this at the source