loomnetwork / plasma-cash

Plasma Cash Contract & Client. ERC721, ERC20, and ETH compatible
https://loomx.io/developers
Other
271 stars 62 forks source link

Fix exploit in challengeAfter with invalid later spends #51

Closed gakonst closed 6 years ago

gakonst commented 6 years ago

fixes a critical bug in challengeAfter implementation. Previously it allowed an exit to be challenged by any subsequent spend. That is a broken game, as an adversary can generate an invalid future spend of a coin and invalidate that user's exits. testExploit.js in the first commit can be run to validate that the exploit is valid. later commits fix the issue.