anza-xyz / octane

Octane is a gasless transaction relayer for Solana.
Apache License 2.0
218 stars 128 forks source link

Revert returning signature in API methods w/o sending the transaction #18

Closed sevazhidkov closed 2 years ago

sevazhidkov commented 2 years ago

Previously I introduced an option to send transaction via your own RPC endpoint. However, it allows a "bad state" attack: user can request a signature (passing the simulation), then break the conditions for transaction success (for example, by withdrawing all of the tokens), then submit the transaction with no-checks option and previously received signature. The transaction will fail, but the transaction fee would be spent regardless.