LedgerHQ / ledger-fresh-management

This is where product topics are discussed for Ledger Fresh
Apache License 2.0
14 stars 2 forks source link

[On-chain] - Plugin reset functionnality #59

Open qd-qd opened 1 year ago

qd-qd commented 1 year ago

Header

Name of the task: Plugin reset functionnality

Name of the module: On-chain

Difficulty: 3

Waiting for: /

Body

Short description

Ledger, Argent, and Cartridge collaborated to create a smart-contract wallet that can be configured with plugins. The plugins have been spec'ed by them. However, there is something in the implementation that we see as a problem for our product.

Full description

Ledger Fresh will come with a Plugin Store that will let users easily install different types of plugins. During the life of a wallet, plugins will be updated, replaced, etc...

In the current specification, the memory area used by the plugin isn't reset when you uninstall it. Meaning if you uninstall a plugin, then reinstall it years later, the variables you saved in memory when you used the plugin the first time will be used by the plugin again after you reinstall it. This behavior creates security concerns and must be tackled for large-scale use as we imagine it. This is the goal of this task. Here are the subtasks that must be done to validate the task.

The plugin must be a contribution here, it must respect the CONTRIBUTING file, and everything must be tested. Take into account that this change impacts the collaborative work of Ledger, Argent, and Cartridge. Feel free to discuss this with them when necessary.

Additionals ressources

github-actions[bot] commented 1 year ago

Task monitoring 📝


This is an automatic post that is intended to facilitate the follow-up of the project. This post is meant to be edited throughout the life of the project.