search

polymorpher / one-wallet

1wallet | Modulo OTP Wallet - unconventional keyless, non-custodial wallet secured by Google Authenticator. EVM-compatible, smart contract operated, with composable security.
https://1wallet.crazy.one
Apache License 2.0
112 stars 48 forks source link

Swap and tokens: non-urgent issues #122

Closed polymorpher closed 3 years ago

polymorpher commented 3 years ago

Swap feature is added and deployed in v0.10.2. Currently, it is only visible in dev mode. I will make it available generally (i.e. not just dev mode) in v0.11, after some more extensive internal testing, and issue (1) in the list below is addressed.

  1. Daily limit on the 1wallet contract is not restricting the amount of ONE sent via contract call - including swapping. This means the user (or potentially, an attacker) could circumvent the daily limit mechanisms by swapping all ONEs to tokens, and send the tokens out, while ignoring daily limits on ONEs. This should not be allowed. I will make another majorVersion upgrade (v11) to fix that, before deploying and make Swap available to everyone in production.
  2. Tokens don’t auto transfer to new wallet after upgrade. However, since the new wallet (post-upgrade) can ask the old wallet to transfer the tokens to new wallet, and several functions were designed to do exactly that (partly to deal with this potential pitfall), I decided to leave this problem to be addressed later.
    • The reason is purchasing or swapping tokens on SushiSwap don't cause the tokens to be "tracked" on 1wallet. Only spending those tokens inside 1wallet would track the tokens on the 1wallet smart contract.
polymorpher commented 3 years ago

(1) is resolved

polymorpher commented 3 years ago

Resolved by https://github.com/polymorpher/one-wallet/releases/tag/v0.13.1 . Not ideal but good enough for now