allora-network / allora-chain

Node software to run the Allora Network
https://www.allora.network/
Apache License 2.0
73 stars 67 forks source link

Prevent calling RemoveStake/RemoveDelegateStake with negative amount #441

Closed relyt29 closed 1 month ago

relyt29 commented 1 month ago

What is the purpose of the change

This PR fixes a critical-severity issue that would allow any random person on the internet to denial of service the Allora chain, by sending a negative Coin amount to the RemoveDelegateStake function. The fix merely checks that the value is positive, thereby preventing an eventual panic and halt of the chain.

Testing and Verifying

This change added tests that check that you cannot try to RemoveStake of negative amounts of coins.

Documentation and Release Note

This PR has no implications on documentation.

relyt29 commented 1 month ago

Closes ORA-1928