search

WICG / trust-token-api

Trust Token API
https://wicg.github.io/trust-token-api/
Other
413 stars 82 forks source link

Unbalanced limits on redemption records and token issuance #276

Open aechiara opened 8 months ago

aechiara commented 8 months ago

The specification draft limits the number of redemption records an issuer can create to 2 within a lifespan of 48 hours. However, the specification also allows an issuer to issue up to 500 tokens.

This seems to be an unbalanced ratio, as an issuer could potentially issue a large number of tokens that cannot be redeemed in a timely manner.

Shouldn't the issuance x redemption ratio be balanced ?

@isabelcurado @thiagodiogo

aykutbulut commented 8 months ago

Tokens are from (for/associated with) issuers. Redemption records (and redemption operation in general) are for (associated with) top level origin and issuer pairs.

Redemption is limited for the same top level origin and issuer pair. This is to prevent a malicious origin to redeem all the tokens stored.