MinaFoundation / mina-fungible-token

https://minafoundation.github.io/mina-fungible-token/
Apache License 2.0
5 stars 1 forks source link

Eliminate DoS vulnerability in the reducer calculating the circulating supply #66

Open kantp opened 1 week ago

kantp commented 1 week ago

There are two ways of doing this:

  1. Using a dedicated account to track the number of tokens in circulation via the balance of that account. This is a significant simplification to the way that was suggested during the audit. It will allow us to go without actions/reducers, reduce some code (including code that is duplicated in two functions), and generally reduce the complexity -- all at the cost of creating one more account. This does have the downside, however, that we will not be able to use the current circulation in preconditions of proofs, which is quite prohibitive.

  2. Using the recursive snapshot reducer pattern. This one is adding complexity, but it will allow us to use the circulation in proof preconditions. So we should do this.

kantp commented 3 days ago

We can also use the first option, and document that when a token issuer wants to have a limit on the supply, they should have an requireBetween on the supply tracking balance.