wen-community / wen-program-library

Apache License 2.0
90 stars 18 forks source link

Validate Distribution account in ```approve``` #49

Open balmy-gazebo opened 5 months ago

balmy-gazebo commented 5 months ago

Currently we are not validating the distribution account because this instruction in general is called assuming marketplaces properly account for royalties, however it is poor DX to allow ambiguous distribution accounts as uncaught errors will lead to loss of funds for creators if their distribution account were passed in incorrectly by a marketplace.

The hold up implementing this is that it would require passing in the group account to derive the Distribution PDA in approve. Once the Group Account is apart of the mint account we should be able to make this check. In the mean time potentially we should add a warning to the documentation.

kespinola commented 3 months ago

Given that a marketplace can pass any amount to royalty distribution thus by passing it enforcement I strongly encourage dropping the protocol and instead provide interface for assisting in the paying out royalties consistently in all protocol utilizing WNS assets and leverage token extension guards to prevent bad actors.