ethereum-attestation-service / eas-sdk

Ethereum Attestation Service - TypeScript/JavaScript SDK
MIT License
89 stars 45 forks source link

Validate Resolver Contract When Registering Schema #107

Open RojhatToptamus opened 1 month ago

RojhatToptamus commented 1 month ago

Currently the register function on schema-registry.ts accepts any contract as a resolver. We need to ensure that only valid resolver contracts are accepted. I faced this issue earlier when I accidentally provided an invalid resolver contract address and it was hard to debug the issue.

Proposed Fix Adding a check in the register function to verify that the given resolver contract inherits from the ISchemaResolver might prevent non resolver contracts from being accepted.

  async verifyResolver(contractAddress: string) {
    const provider = this.contract.runner?.provider;
    if (!provider) {
      throw new Error('Provider is not available');
    }
    const schemaResolverInterface = ISchemaResolver__factory.createInterface();
    const resolverByteCode = await provider.getCode(contractAddress);
    const interfaceAbi = schemaResolverInterface.fragments.map((fragment) => fragment.format());
    const functionSelectors = interfaceAbi.map((func) => id(func).substring(0, 10));
    const isValidResolver = functionSelectors.every((selector) => resolverByteCode.includes(selector.substring(2)));
    return isValidResolver;
  }
lbeder commented 1 month ago

Hi @RojhatToptamus, This is an interesting idea, but this is something that it would be better to check on the contract level (using something like supportsInterface, for example), but I'm also not 100% sure that we want to impose that (i.e., we do require implementing the ISchemaRegistry interface, but users don't have to use the SchemaRegistry explicitly). We will definitely make a note of this for future versions.