feat: add native fee restriction (#280)

* feat: add native fee restriction

* tests: add tests

* chore: formatting

* test: fix ACL test

* chore: clippy

* chore: rust warning unused variable

* Change sender_id to signer_id

* Move this up

* Linting

* Optimizations

* clippy + short-circuit

* formatting

Author: r-near

near/omni-bridge/src/lib.rs

@@ -88,6 +88,7 @@ pub enum Role {
     MetadataManager,
     UnrestrictedRelayer,
     TokenControllerUpdater,
+    NativeFeeRestricted,
 }
 
 #[ext_contract(ext_token)]
@@ -198,6 +199,17 @@ impl FungibleTokenReceiver for Contract {
     ) -> PromiseOrValue<U128> {
         let parsed_msg: InitTransferMsg = serde_json::from_str(&msg).sdk_expect("ERR_PARSE_MSG");
         let token_id = env::predecessor_account_id();
+
+        // User has to pay for storage and we can't trust sender_id.
+        let signer_id = env::signer_account_id();
+
+        // Avoid extra storage read by verifying native fee before checking the role
+        if parsed_msg.native_token_fee.0 > 0
+            && self.acl_has_role(Role::NativeFeeRestricted.into(), signer_id.clone())
+        {
+            env::panic_str("ERR_ACCOUNT_RESTRICTED_FROM_USING_NATIVE_FEE");
+        }
+
         require!(
             parsed_msg.recipient.get_chain() != ChainKind::Near,
             "ERR_INVALID_RECIPIENT_CHAIN"
@@ -224,9 +236,6 @@ impl FungibleTokenReceiver for Contract {
             "ERR_INVALID_FEE"
         );
 
-        // User has to pay for storage and we can't trust sender_id.
-        let signer_id = env::signer_account_id();
-
         let mut required_storage_balance =
             self.add_transfer_message(transfer_message.clone(), signer_id.clone());
         required_storage_balance = required_storage_balance

near/omni-tests/src/lib.rs

@@ -1,4 +1,5 @@
 mod fin_transfer;
 mod helpers;
 mod init_transfer;
+mod native_fee_role;
 mod omni_token;