search

stellar / django-polaris

An extendable Django app for building modular Stellar services
https://django-polaris.readthedocs.io
Apache License 2.0
96 stars 70 forks source link

Does SEP-24 allow deposits and withdraws to & from unauthenticated accounts? #604

Open yuriescl opened 2 years ago

yuriescl commented 2 years ago

I generated a SEP-10 token using an account (not muxed), and then used that SEP-10 token in a SEP-24 deposit call with another account value. It successfully gave me a interactive URL response. Is this an expected behavior? Shouldn't SEP-24 only allow depositing only to the same account authenticated in SEP-10?

Polaris v2.2.0

JakeUrban commented 2 years ago

Hi @yuriescl, this is the expected behavior. It supports the case where the user's funds are held by an account that cannot be used to authenticate via SEP-10.

For example, if a custodial wallet uses Circle or Fireblocks to custody their users' funds, the wallet cannot use the account held by the custody service in SEP-10 because the wallet doesn't have access to the secret key.

In this case, the wallet needs to use a different keypair that they do have access to in SEP-10. This other keypair doesn't need to be funded on the network. However, the actual source of funds will still be the account held by the custody service.