Joystream / Joystream/joystream
`claim_and_withdraw_channel_reward` can bypass revenue split
- Dominant language
- Rust
- Stars
- 1.4k
- Forks
- 116
- PR merge metrics
- No merged PRs in 30d
Description
`withdraw_from_channel_balance` contains a very important check to ensure no creator token is issued for the channel, as that would allow bypassing the revenue split logic: https://github.com/Joystream/joystream/blob/master/runtime-modules/content/src/lib.rs#L1661
However, the same check is **not present** in `claim_and_withdraw_channel_reward` which is a utility extrinsic to claim the channel reward and withdraw it at the same time.
Potential solutions:
- Refactor common withdrawal-related checks into `ensure_can_withdraw` function and use it in both `withdraw_from_channel_balance` and `claim_and_withdraw_channel_reward`
- Drop `claim_and_withdraw_channel_reward` completely, as it has questionable utility when compared to `utility.batch` approach and introduces extra complexity and risks
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.