snapshot-labs / boost

A protocol for token distribution
MIT License
13 stars 5 forks source link

investigate: anyone can force a claim #28

Closed pscott closed 9 months ago

pscott commented 10 months ago

Right now, we don't verify that the claim originates from the recipient. Meaning Alice can "force" Bob to claim. There might be reasons why Bob would not want to claim a boost (didn't want to be incentivized, didn't want the boostOwner's money (e.g terrorism etc), and other reasons).

Should we only allow Alice to claim for Bob if Bob has confirmed it to her (i.e, Bob has given a signature to Alice). Or even, should we disallow claiming for someone else, and only allow Alice to claim for Alice and Bob to claim for Bob?

pscott commented 9 months ago

Deemed as not to be a concern.