purse is published in the registry?

[dckc]

this code looks like it's putting a purse in the registry. So anyone can look it up and spend the REV from that purse. Am I reading this right?

https://github.com/fabcotech/rchain-token/blob/d2625ad8ee9426eec66db361d032106284194d05/src/purchaseTokensTerm.js#L102-L117

[fabcotech]

Great point ! Yes, a purse is in fact sent to the rchain-token contract (through the registry), two critical issues with the current code:

• (1) If the PURCHASE_TOKENS execution does not succeed, the purse keeps its REV, and the issuer is not reimbursed
• (2) The channel exposed to the registry is not protected, anyone can intercept payloads and steal REV from purses https://github.com/fabcotech/rchain-token/blob/master/main.rho#L581

[fabcotech]

• Issue (1) was fixed in commit b6854ddc9f5ea06c1fb5b669fdb4884d83673269, there is now a refund mechanism when the transfer fails for some reason (most probably induffisient fund in purse)
• Issue (2) was resolved by exposing bundle+{*entryCh} instead of entryCh to the registry.

https://github.com/fabcotech/rchain-token/commit/b6854ddc9f5ea06c1fb5b669fdb4884d83673269 https://github.com/fabcotech/rchain-token/commit/2fcadb8a7480e0085b3d7cc04d319c33735157d6

Closing, you can unclose if you think there's still something wrong.

[dckc]

OK, so I wasn't reading the code right; the purse wasn't published in the registry. What's published in the registry is a contract where the purse is sent.