[M1: Audit 2: L-11]: CIP112: Bind the admin in the custom example and document that roles on a rules contract do not bind the admin

Open
  • Is something wrong?
#95 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
48/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Domain
blockchain, documentation, security

Research direction

Start with the custom example in examples/token/token-cip112-custom/daml/OpenZeppelin/Examples/Token/Cip112/Custom.daml and trace how its rules and holding-related contracts are signed. Then update the named TokenRules, HoldingOps, utils README, custom-example README, and integration guide to explain the trust boundary and co-signing tradeoffs. Done means the example and all four documentation locations consistently distinguish operator practice from ledger enforcement.

Written by the indexing model from the issue text.

Description

Addresses L-11

Changes

The default TokenRules is not affected: it carries only admin-set parameters, so a second rules contract gives the admin nothing it does not already have. Custom tokens that put roles held by other parties on the rules contract are affected, because consumeLockedHolding and consumeUnlockedHolding accept any holding whose admin matches, whichever rules contract issued it. The utils cannot close this gap: any check they make compares fields that the admin can copy into a contract it signs alone. Only a signature from another party binds the admin.

Code:

  • The custom example should make the pauser a co-signer of MyRules, MyHolding, MyTransferInstruction, and MyAllocation. The admin then cannot create a second rules contract, or any other contract that creates or spends holdings, without the pauser, and so cannot get around the pause, the executor allowlist, the fee, or the roles. This makes the example's claim that the admin holds neither the pauser's nor the compliance officer's power true.

Documentation:

  • TokenRules, the consumeHolding law in HoldingOps, and the trust boundary in the token-cip112-utils README.md should state that roles on a rules contract restrict wallets only. A control that must bind the admin has to be held by a party that signs the holdings and the pending contracts.
  • The custom example's README.md should describe the co-signing pauser and its privacy, liveness and coordination costs.
  • The integration guide says the operator creates one TokenRules per registry configuration. It should say that this describes operator practice and the ledger does not enforce it.
Dominant language
Haskell
Stars
5
Forks
0
Avg merge
1d 36m
Merged PRs (30d)
11

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from OpenZeppelin/canton-contracts

All issues in OpenZeppelin/canton-contracts

Similar issues

More Haskell issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.