Merge pull request #180 from Spaully/fix/spaully-contract-security

Add contract attempt throttling, hint gating, and tighten CORS

Author: dzekojohn4

backend/src/main.ts

@@ -64,10 +64,7 @@ async function bootstrap(): Promise<void> {
     allowedHeaders: configService.get<string[]>(
       'appConfig.cors.allowedHeaders',
     ) ?? [
-      'Origin',
-      'X-Requested-With',
       'Content-Type',
-      'Accept',
       'Authorization',
     ],
     credentials:

onchain/contracts/stellar_hunts/src/lib.rs

@@ -45,6 +45,7 @@ pub struct LevelProgress {
     pub is_completed: bool,
     pub attempts: u32,
     pub nft_minted: bool,
+    pub last_attempt_ledger: u32,
 }
 
 // ---------------------------------------------------------------------
@@ -82,6 +83,8 @@ pub enum Error {
     WrongLevel = 7,
     QuestionPerLevelLimit = 8,
     MissingNftContract = 9,
+    AttemptTooSoon = 10,
+    LevelImmutable = 11,
 }
 
 // ---------------------------------------------------------------------
@@ -259,7 +262,14 @@ impl StellarHunts {
                     is_completed: false,
                     attempts: 0,
                     nft_minted: false,
+                    last_attempt_ledger: 0,
                 });
+
+        let current_ledger = env.ledger().sequence();
+        if lp.last_attempt_ledger == current_ledger {
+            panic_with_error!(&env, Error::AttemptTooSoon);
+        }
+        lp.last_attempt_ledger = current_ledger;
         lp.attempts += 1;
 
         let hashed: BytesN<32> = env.crypto().sha256(&answer).into();
@@ -332,6 +342,25 @@ impl StellarHunts {
             panic_with_error!(&env, Error::WrongLevel);
         }
 
+        let lp_key = DataKey::PlayerLevelProgress(caller.clone(), q.level.clone());
+        let lp: LevelProgress = env
+            .storage()
+            .persistent()
+            .get(&lp_key)
+            .unwrap_or(LevelProgress {
+                player: caller.clone(),
+                level: q.level.clone(),
+                last_question_index: 0,
+                is_completed: false,
+                attempts: 0,
+                nft_minted: false,
+                last_attempt_ledger: 0,
+            });
+
+        if lp.attempts == 0 {
+            panic_with_error!(&env, Error::NotInitialized);
+        }
+
         env.events().publish(
             (Symbol::new(&env, "hint_requested"),),
             (caller.clone(), question_id, q.level.clone()),
@@ -457,6 +486,7 @@ impl StellarHunts {
                 is_completed: false,
                 attempts: 0,
                 nft_minted: false,
+                last_attempt_ledger: 0,
             })
     }
 
@@ -485,6 +515,7 @@ impl StellarHunts {
             is_completed: false,
             attempts: 0,
             nft_minted: false,
+            last_attempt_ledger: 0,
         };
         env.storage().persistent().set(
             &DataKey::PlayerLevelProgress(player.clone(), Levels::Easy),

onchain/contracts/stellar_hunts_nft/src/lib.rs

@@ -90,6 +90,7 @@ impl StellarHuntsNft {
     /// game contract passes its own contract address as `minter`.
     pub fn mint_level_badge(env: Env, minter: Address, recipient: Address, level: Levels) {
         minter.require_auth();
+
         if !Self::has_minter_role(env.clone(), minter.clone()) {
             panic_with_error!(&env, Error::NotAuthorized);
         }
@@ -100,9 +101,15 @@ impl StellarHuntsNft {
         }
         env.storage().persistent().set(&badge_key, &true);
 
+        let admin: Address = env
+            .storage()
+            .instance()
+            .get(&NftDataKey::Admin)
+            .expect("admin not set");
+
         env.events().publish(
             (Symbol::new(&env, "level_badge_minted"),),
-            (recipient, level, minter),
+            (recipient, level, minter, admin),
         );
     }