Use shielded transaction memo for withdrawal address

willemolding / CarteZcash

A ZCash L2 built as a Cartesi RollApp. Winner of the 2024 Cartesi Online Hackathon.

Apache License 2.0

5 stars 2 forks source link

Closed willemolding closed 3 months ago

willemolding commented 3 months ago

The current method of sending the withdrawal address to the InputBox is insecure as it is malleable.

Instead it should accept the withdrawal address set in the wallet using the encrypted memo field.

TinyCash should be modified to decrypt memos for transactions send to the mt_doom address and return these in the response as the withdraw address.
CarteZcash should be modified to accept a withdrawal eth address from TinyCash instead of from the request