bigchaindb / bigchaindb/cryptoconditions

PreimageSha256 validation returns only True can be dangerous

Open
#26 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
73
Forks
40
PR merge metrics
No merged PRs in 30d

Description

See this method: https://github.com/bigchaindb/cryptoconditions/blob/master/cryptoconditions/types/sha256.py#L120

`PreimageSha256.validate` always yields `True`, while all other respective types validate by checking external parameters (usually the `message` parameter).
A user would expect that calling `.validate` on all present fulfillments in a transaction to (at least partially) validate the transaction.
However, for a `PreimageSha256` fulfillment, a comparison between the input condition and the newly created fulfillment's condition will also have to happen. In BigchainDB, this case is handled here:
https://github.com/bigchaindb/bigchaindb/blob/master/bigchaindb/util.py#L458

To avoid pitfalls for users of this library it would be nice if we could force the submission of the input-condition and then yield the respective boolean in the validate method.

Contributor guide

Open the contributing guide

Research direction

Start with PreimageSha256.validate in cryptoconditions/types/sha256.py around line 120, then read the corresponding handling in bigchaindb/util.py around line 458. Check how other fulfillment types use external parameters and determine the validation behavior for the input condition. Done means the behavior is covered by tests and no longer unconditionally reports success.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
cryptography
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.