bigchaindb / bigchaindb/cryptoconditions
PreimageSha256 validation returns only True can be dangerous
- Dominant language
- Python
- Stars
- 73
- Forks
- 40
- PR merge metrics
- No merged PRs in 30d
Description
See this method: https://github.com/bigchaindb/cryptoconditions/blob/master/cryptoconditions/types/sha256.py#L120
`PreimageSha256.validate` always yields `True`, while all other respective types validate by checking external parameters (usually the `message` parameter).
A user would expect that calling `.validate` on all present fulfillments in a transaction to (at least partially) validate the transaction.
However, for a `PreimageSha256` fulfillment, a comparison between the input condition and the newly created fulfillment's condition will also have to happen. In BigchainDB, this case is handled here:
https://github.com/bigchaindb/bigchaindb/blob/master/bigchaindb/util.py#L458
To avoid pitfalls for users of this library it would be nice if we could force the submission of the input-condition and then yield the respective boolean in the validate method.
Contributor guide
Research direction
Start with PreimageSha256.validate in cryptoconditions/types/sha256.py around line 120, then read the corresponding handling in bigchaindb/util.py around line 458. Check how other fulfillment types use external parameters and determine the validation behavior for the input condition. Done means the behavior is covered by tests and no longer unconditionally reports success.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- cryptography
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100