add hw wallet account check prior to executing operations

full-service/src/json_rpc/v2/api/wallet.rs

@@ -1,6 +1,6 @@
 use crate::{
     db::{
-        account::AccountID,
+        account::{AccountID, AccountModel},
         transaction_log::TransactionId,
         txo::{TxoID, TxoStatus},
     },
@@ -1331,6 +1331,11 @@ where
             let synced_txos = match synced_txos {
                 Some(synced_txos) => synced_txos,
                 None => {
+                    let account = service
+                        .get_account(&AccountID(account_id.clone()))
+                        .map_err(format_error)?;
+                    let view_account_keys = account.view_account_key().map_err(format_error)?;
+
                     let unverified_txos = service
                         .list_txos(
                             Some(account_id.clone()),
@@ -1360,7 +1365,9 @@ where
                         })
                         .collect::<Result<Vec<_>, JsonRPCError>>()?;
 
-                    sync_txos(unsynced_txos).await.map_err(format_error)?
+                    sync_txos(unsynced_txos, &view_account_keys)
+                        .await
+                        .map_err(format_error)?
                 }
             };
 

full-service/src/service/hardware_wallet.rs

@@ -6,6 +6,7 @@ use std::convert::{TryFrom, TryInto};
 
 use ledger_mob::{DeviceHandle, Filters, LedgerHandle, LedgerProvider, Transport};
 
+use mc_account_keys::ViewAccountKey;
 use mc_common::logger::global_log;
 use mc_core::account::{ViewAccount, ViewSubaddress};
 use mc_crypto_keys::RistrettoPublic;
@@ -25,6 +26,7 @@ pub enum HardwareWalletServiceError {
     KeyImageNotFoundForSignedInput,
     RingCT(mc_transaction_core::ring_ct::Error),
     CryptoKeys(mc_crypto_keys::KeyError),
+    CredentialMismatch,
 }
 
 impl From<mc_transaction_core::ring_ct::Error> for HardwareWalletServiceError {
@@ -70,9 +72,18 @@ async fn get_device_handle() -> Result<DeviceHandle<LedgerHandle>, HardwareWalle
 
 pub async fn sync_txos(
     unsynced_txos: Vec<(TxOut, u64)>,
+    view_account: &ViewAccountKey,
 ) -> Result<Vec<TxoSynced>, HardwareWalletServiceError> {
     let mut device_handle = get_device_handle().await?;
 
+    // Check device and requested accounts match
+    let device_keys = device_handle.account_keys(0).await?;
+    if device_keys.view_private_key() != view_account.view_private_key()
+        || device_keys.spend_public_key() != view_account.spend_public_key()
+    {
+        return Err(HardwareWalletServiceError::CredentialMismatch);
+    }
+
     let mut synced_txos = vec![];
     for unsynced_txo in unsynced_txos {
         let tx_public_key = (&unsynced_txo.0.public_key).try_into()?;
@@ -103,9 +114,19 @@ pub async fn get_view_only_subaddress_keys(
 
 pub async fn sign_tx_proposal(
     unsigned_tx_proposal: UnsignedTxProposal,
+    view_account: &ViewAccountKey,
 ) -> Result<TxProposal, HardwareWalletServiceError> {
     let mut device_handle = get_device_handle().await?;
 
+    // Check device and requested accounts match
+    let device_keys = device_handle.account_keys(0).await?;
+    if device_keys.view_private_key() != view_account.view_private_key()
+        || device_keys.spend_public_key() != view_account.spend_public_key()
+    {
+        return Err(HardwareWalletServiceError::CredentialMismatch);
+    }
+
+    // Sign transaction proposal
     global_log::debug!("Signing tx proposal with hardware device");
     let (tx, txos_synced) = device_handle
         .transaction(0, 60, unsigned_tx_proposal.unsigned_tx)

full-service/src/service/models/tx_proposal.rs

@@ -66,7 +66,7 @@ impl UnsignedTxProposal {
         match account.view_only {
             true => {
                 global_log::debug!("signing tx proposal with hardware wallet");
-                Ok(hardware_wallet::sign_tx_proposal(self).await?)
+                Ok(hardware_wallet::sign_tx_proposal(self, &account.view_account_key()?).await?)
             }
             false => {
                 global_log::debug!("signing tx proposal with local signer");