(WIP) Challenge before bug fix & potential startExit fix?

[aupiff]

As I was working on a test to demonstrate a challengeBefore bug I brought up to @gakonst, I think I discovered an exploit where anyone can submit a valid exit for another user and then claim their coin.

• Dirty, in-place demo of the startExit exploit is to be found in server/test/testCooperativeExits.js
  • @gakonst can you please verify that this should not be possible and cannot currently be challenged in any way?
• WIP challengeBefore exploit is in server/test/testChallengeBeforeExploit.js (lots of the code here is commented out)

It's late, sorry for the messy WIP PR...

[gakonst]

Fixed the startExit but by requiring that the msg.sender when initiating an exit is the exiting transaction's owner.

In the context of delegated exits this can be slightly modified so that the exiting transaction's owner is stored in pushExit instead of msg.sender. This however means that anybody could start exiting coins of other users which would be a usability problem. As a mitigation to this, a user could approve a list of users and only allow them to exit their coin (in addition to the user himself of course). This is an additional feature and I do not consider it high priority just yet, so the sanity check in the beginning of the exit is sufficient.

As for the challengeBefore bug, renamed the variable responses to challenges and made it a struct which stores the challenge owner as well as the block at which a challenge was initiated.

For a valid response, a user must provide a spend signed by the challenge's owner which happened at a later block than the challenge's block, which was not the case before.