Fix/quote write and accept signature - #351
Merged
james2177 merged 3 commits intoSep 2, 2026
Merged
Conversation
quote() is intentionally unauthenticated for price discovery, but when dto.intentId is supplied it persists quotedDstAmount onto that intent. Any caller who knows an intent's UUID (public via list/create responses and the WS feed) could overwrite quotedDstAmount with a value computed from an arbitrary, unrelated token pair/amount. Now the request's srcChain/srcToken/dstToken/srcAmount are cross-checked against the target intent's stored fields and a mismatch is rejected with a 400. Kept ownership-agnostic (no signature) rather than requiring proof of ownership, since adding auth to this write path would mean adding signature verification to quote(), which is out of scope and inconsistent with the endpoint remaining public for price discovery. Strict content-matching closes the arbitrary-write vector without changing quote()'s access model.
accept() checked that the solver was registered, active, and bonded, but never called verifyStellarSignature() despite AcceptIntentDto already carrying a signature field intended for exactly this. Since a solver's public address is public (visible on the leaderboard), any caller could accept an intent "as" that solver by supplying any string >= 10 chars as signature, letting an attacker grief a competitor solver into a fill obligation it never agreed to (and, once slashing lands, get its bond slashed for missing the window). Now accept() calls verifyStellarSignature(dto.solver, buildAcceptMessage(id, dto.solver), dto.signature) before acceptIfOpen(), mirroring fill()'s and cancel()'s existing pattern. scripts/solver-bot.ts already signs via buildAcceptMessage() + sign() and needs no changes.
|
@martinzhames Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
closes #321
closes #322
closes #292
closes #291