search

btc-vision / btc-runtime

Assemblyscript btc runtime
MIT License
4 stars 2 forks source link

OP_20 transferFrom incorrectly uses Blockchain.origin instead of Blockchain.sender #33

Closed liquitious closed 1 week ago

liquitious commented 2 weeks ago 
const spender = Blockchain.origin;
const fromAllowanceMap = this.allowanceMap.get(from);
const allowed: u256 = fromAllowanceMap.get(spender);

Normal flow is alice approves contractA to transfer tokens from her account. Then she calls a method in contractA that would call tokenContract.transferFrom. However, bc spender = Blockchain.origin this is going to check that alice approved alice to do a transfer instead of alice approved contractA. It ends up not working for the normal uses cases of approve and transferFrom. It would work if const spender = Blockchain.sender;

bug is here: https://github.com/btc-vision/btc-runtime/blob/2ab2144aeb89c1826b8579813fb51f0e6c49255f/runtime/contracts/DeployableOP_20.ts#L358

Note: unable to test this due to bug where Blockchain.sender is not correct. It is always equal to what is passed/mocked in unit tests and does not work in case where a contract calls another contract