Skip to content

Fee amount validation #2122

Open
Open
@abitmore

Description

@abitmore

Bug Description
Most non-virtual operations have a check FC_ASSERT(fee.amount >= 0) in validate() function. But some are different.

  • blind_transfer_operation doesn't check fee.amount;
  • proposal_create_operation doesn't check fee.amount;
  • custom_operation checks fee.amount > 0, which is practically fine but not perfect;
  • balance_claim_operation checks fee.amount == asset(), which is fine.

Anyway, there is a check FC_ASSERT( fee.amount >= 0 ) in generic_evaluator::prepare_fee(), so the chain won't allow any user to pay a negative fee, which means we're safe. However, since the check is done in evaluators, there exists a minor issue that a user can wrap an operation with a negative fee in a proposal_create_operation which could be accepted by the chain, just a bit annoying.

Impacts
Describe which portion(s) of BitShares Core may be impacted by this bug. Please tick at least one box.

  • API (the application programming interface)
  • Build (the build process or something prior to compiled code)
  • CLI (the command line wallet)
  • Deployment (the deployment process after building such as Docker, Travis, etc.)
  • DEX (the Decentralized EXchange, market engine, etc.)
  • P2P (the peer-to-peer network for transaction/block propagation)
  • Performance (system or user efficiency, etc.)
  • Protocol (the blockchain logic, consensus, validation, etc.)
  • Security (the security of system or user data, etc.)
  • UX (the User Experience)
  • Other (please add below)

CORE TEAM TASK LIST

  • Evaluate / Prioritize Bug Report
  • Refine User Stories / Requirements
  • Define Test Cases
  • Design / Develop Solution
  • Perform QA/Testing
  • Update Documentation

Metadata

Metadata

Assignees

No one assigned

    Labels

    3d BugClassification indicating the existing implementation does not match the intention of the design4a Low PriorityPriority indicating minimal impact to system/user -OR- an inexpensive workaround exists

    Type

    No type

    Projects

    No projects

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions