Joystream / Joystream/joystream

`claim_and_withdraw_channel_reward` can bypass revenue split

Open
#4,595 3 comments 0 reactions 1 assignee Claimed by @dobertRowneySr View on GitHub
bug crt-v1 project_token runtime
Dominant language
Rust
Stars
1.4k
Forks
116
PR merge metrics
No merged PRs in 30d

Description

`withdraw_from_channel_balance` contains a very important check to ensure no creator token is issued for the channel, as that would allow bypassing the revenue split logic: https://github.com/Joystream/joystream/blob/master/runtime-modules/content/src/lib.rs#L1661

However, the same check is **not present** in `claim_and_withdraw_channel_reward` which is a utility extrinsic to claim the channel reward and withdraw it at the same time.

Potential solutions:
- Refactor common withdrawal-related checks into `ensure_can_withdraw` function and use it in both `withdraw_from_channel_balance` and `claim_and_withdraw_channel_reward`
- Drop `claim_and_withdraw_channel_reward` completely, as it has questionable utility when compared to `utility.batch` approach and introduces extra complexity and risks

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.