search

near / mpc

30 stars 6 forks source link

`remove_request` isn't guarded #575

Closed mikedotexe closed 2 months ago

mikedotexe commented 2 months ago

If a random account calls remove_request, it looks like it'll immediately remove it, regardless of whether they own it.

https://github.com/near/mpc-recovery/blob/e89ff439ead0c2fc8e53043625241ece38dad2b8/contract/src/lib.rs#L461-L464

I suggest we consider taking an approach similar to what Sareth did in his near-sdk-rs example here:

https://github.com/saketh-are/near-sdk-rs/blob/9cc3a9ab236eb3ee69bb2a52a218736b5aca4fe3/examples/mpc-contract/src/lib.rs#L12-L24

Feels like if we're going to allow people to remove requests, we'll have to store the predecessor somewhere the first time.

timurguvenkaya commented 2 months ago

Hey there

In NEAR, if there is no pub keyword, the method is not callable externally

https://docs.near.org/sdk/rust/contract-interface/private-methods

volovyks commented 2 months ago

Yes, thank you @timurguvenkaya @mikedotexe we will refactor the contract to separate its API from the service functions. The pattern is good, we may accept it. Let's continue this discussion here: https://github.com/near/mpc-recovery/issues/473