Skip to content

fix: reject aliased ids in allowance owner and delegating spender - #26794

Open
ibankov wants to merge 1 commit into
mainfrom
delegating-spender-alias-fix
Open

fix: reject aliased ids in allowance owner and delegating spender#26794
ibankov wants to merge 1 commit into
mainfrom
delegating-spender-alias-fix

Conversation

@ibankov

@ibankov ibankov commented Aug 12, 2026

Copy link
Copy Markdown
Contributor

Description:

Allowance transactions resolve account ids by number, so an AccountID carrying an alias names no account and should be rejected rather than read as an absent field.

  • getEffectiveOwner now falls back to the payer only when the owner is absent (null or AccountID.DEFAULT) or names the payer. An aliased or zero-numbered owner fails with INVALID_ALLOWANCE_OWNER_ID.
  • isDelegatingSpenderPresent no longer reads an id as a number unconditionally, so an aliased delegating_spender fails with INVALID_DELEGATING_SPENDER.
  • CryptoApproveAllowanceHandler's private copy of the owner check shares one predicate with the validator, comparing full account ids instead of account numbers alone.

Signed-off-by: Ivan Bankov <ivan.bankov@limechain.tech>
@ibankov
ibankov requested review from a team as code owners August 12, 2026 07:42
@lfdt-bot

Copy link
Copy Markdown

Snyk checks have passed. No issues have been found so far.

Status Scan Engine Critical High Medium Low Total (0)
Open Source Security 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

@ibankov ibankov self-assigned this Aug 12, 2026
@ibankov ibankov added this to the v0.79 milestone Aug 12, 2026
@codecov

codecov Bot commented Aug 12, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

Impacted file tree graph

@@            Coverage Diff            @@
##               main   #26794   +/-   ##
=========================================
  Coverage     70.49%   70.49%           
- Complexity    11670    11675    +5     
=========================================
  Files          2583     2583           
  Lines        108296   108301    +5     
  Branches      12107    12109    +2     
=========================================
+ Hits          76342    76352   +10     
+ Misses        27977    27975    -2     
+ Partials       3977     3974    -3     
Files with missing lines Coverage Δ Complexity Δ
...n/impl/handlers/CryptoApproveAllowanceHandler.java 75.93% <100.00%> (+0.72%) 49.00 <2.00> (ø)
...vice/token/impl/validators/AllowanceValidator.java 95.12% <100.00%> (+3.69%) 24.00 <6.00> (+5.00)
...ken/impl/validators/ApproveAllowanceValidator.java 94.44% <ø> (ø) 22.00 <0.00> (ø)

... and 1 file with indirect coverage changes

Impacted file tree graph

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@testlens-app

testlens-app Bot commented Aug 12, 2026

Copy link
Copy Markdown

✅ All tests passed ✅

🏷️ Commit: 11e98fd
▶️ Tests: 21861 executed
⚪️ Checks: 54/54 completed


Learn more about TestLens at testlens.app.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants