Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Restricting access to EVM callback #121

Open
halo3mic opened this issue Dec 6, 2023 · 0 comments
Open

Restricting access to EVM callback #121

halo3mic opened this issue Dec 6, 2023 · 0 comments
Labels
help wanted Extra attention is needed

Comments

@halo3mic
Copy link
Contributor

halo3mic commented Dec 6, 2023

SuaveTransaction execution environment doesn't expose any properties of ConfidentialRequest that invoked it.

Rationale

Suppose you have a confidential method bid() which allows you to simulate payment tx; store it in confidential store etc.. The contract returns a callback to bidCallback(), a public non-confidential method. It has to be public and external to be called by the ConfidentialComputeRequest-sender in the SuaveTransaction.
Now, lets say you want to store the bid information and emit a lot, so you pass the data to the callback and store it during SuaveTransaction. But because the callback is public anybody can call it and change the storage or emit the log.

I tackled this by implementing ConfidentialControl using hash-based access control (implementation). But this requires unnecessary confidential initialisation of the contract and gas spent on guard checks.

Implementation

I'm not sure what implementation is the best for this. One way I believe it could work is to create a non-confidential precompile that returns the recipient field of the ConfidentialRequest used to invoke the SuaveTransaction. This way it is much easier and less gas intensive to create a guard that restricts access to the callback method.

@dmarzzz dmarzzz added the help wanted Extra attention is needed label Jan 9, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
help wanted Extra attention is needed
Projects
None yet
Development

No branches or pull requests

2 participants