timewave-computer / valence-services

Other
3 stars 0 forks source link

Allow only valence accounts to register to a service? #4

Closed Art3miX closed 10 months ago

Art3miX commented 11 months ago

Currently anyone can register to any service, not only valence accounts.

To use a service without any errors, you need 2 requirements:

  1. to be a contract
  2. Implement specific messages that a service might execute on the account.

We can do a very basic verification when user tries to register to a service, we can create a simple query on valence account "IsValenceAccount", if that query fails, it means its 100% not a valence account.

But if it passes, it means either:

  1. its a valence account
  2. its a contract that implement this query for some reason (probably a malicious reason)

I think its a good enough way to do a simple verification, to avoid innocent mistakes, like registering a wallet to rebalancer without creating valence account first.

Art3miX commented 11 months ago

One extra way of doing it better, is by whitelisting code ids, and checking if the sender has valence account code id or not, this checks 2 things:

  1. Its a contract, because it has a code id.
  2. Its valence account, because its a whitelisted code id.

This code id check can be expended into checking whitelisted contracts in general in the future, for example if we want to verify its a valid auction contract, we can check against it, or verify services managers of other companies, etc.