From f9b633bbae711e500acb341bdd81cc2da93d1bb7 Mon Sep 17 00:00:00 2001
From: Steven Allen <steven@stebalien.com>
Date: Thu, 2 Mar 2023 13:34:12 -0800
Subject: [PATCH] verifreg: Avoid re-using state between transactions (#1220)

---
 actors/verifreg/src/lib.rs | 62 ++++++++++++++++++--------------------
 1 file changed, 29 insertions(+), 33 deletions(-)

diff --git a/actors/verifreg/src/lib.rs b/actors/verifreg/src/lib.rs
index c08980342..0be46eab2 100644
--- a/actors/verifreg/src/lib.rs
+++ b/actors/verifreg/src/lib.rs
@@ -106,7 +106,6 @@ impl Actor {
         }
 
         let verifier = resolve_to_actor_id(rt, &params.address, true)?;
-
         let verifier = Address::new_id(verifier);
 
         let st: State = rt.state()?;
@@ -138,10 +137,8 @@ impl Actor {
         let verifier = resolve_to_actor_id(rt, &params, false)?;
         let verifier = Address::new_id(verifier);
 
-        let state: State = rt.state()?;
-        rt.validate_immediate_caller_is(std::iter::once(&state.root_key))?;
-
         rt.transaction(|st: &mut State, rt| {
+            rt.validate_immediate_caller_is(std::iter::once(&st.root_key))?;
             st.remove_verifier(rt.store(), &verifier).context("failed to remove verifier")
         })
     }
@@ -165,39 +162,38 @@ impl Actor {
         let client = resolve_to_actor_id(rt, &params.address, true)?;
         let client = Address::new_id(client);
 
-        let st: State = rt.state()?;
-        if client == st.root_key {
-            return Err(actor_error!(illegal_argument, "root cannot be added as client"));
-        }
+        rt.transaction(|st: &mut State, rt| {
+            if client == st.root_key {
+                return Err(actor_error!(illegal_argument, "root cannot be added as client"));
+            }
 
-        // Validate caller is one of the verifiers, i.e. has an allowance (even if zero).
-        let verifier = rt.message().caller();
-        let verifier_cap = st
-            .get_verifier_cap(rt.store(), &verifier)?
-            .ok_or_else(|| actor_error!(not_found, "caller {} is not a verifier", verifier))?;
+            // Validate caller is one of the verifiers, i.e. has an allowance (even if zero).
+            let verifier = rt.message().caller();
+            let verifier_cap = st
+                .get_verifier_cap(rt.store(), &verifier)?
+                .ok_or_else(|| actor_error!(not_found, "caller {} is not a verifier", verifier))?;
 
-        // Disallow existing verifiers as clients.
-        if st.get_verifier_cap(rt.store(), &client)?.is_some() {
-            return Err(actor_error!(
-                illegal_argument,
-                "verifier {} cannot be added as a verified client",
-                client
-            ));
-        }
+            // Disallow existing verifiers as clients.
+            if st.get_verifier_cap(rt.store(), &client)?.is_some() {
+                return Err(actor_error!(
+                    illegal_argument,
+                    "verifier {} cannot be added as a verified client",
+                    client
+                ));
+            }
 
-        // Compute new verifier allowance.
-        if verifier_cap < params.allowance {
-            return Err(actor_error!(
-                illegal_argument,
-                "add more DataCap {} for client than allocated {}",
-                params.allowance,
-                verifier_cap
-            ));
-        }
+            // Compute new verifier allowance.
+            if verifier_cap < params.allowance {
+                return Err(actor_error!(
+                    illegal_argument,
+                    "add more DataCap {} for client than allocated {}",
+                    params.allowance,
+                    verifier_cap
+                ));
+            }
 
-        // Reduce verifier's cap.
-        let new_verifier_cap = verifier_cap - &params.allowance;
-        rt.transaction(|st: &mut State, rt| {
+            // Reduce verifier's cap.
+            let new_verifier_cap = verifier_cap - &params.allowance;
             st.put_verifier(rt.store(), &verifier, &new_verifier_cap)
                 .context("failed to update verifier allowance")
         })?;