cardano-foundation / cardano-foundation/cardano-rosetta-java

Enforce and cross-verify `account_identifier.address` in all stake-related operations

Open
#494 0 comments 0 reactions 1 assignee Claimed by @linconvidal View on GitHub
archeology enhancement needs review
Dominant language
Java
Stars
26
Forks
15
Avg merge
5d 3h
Merged PRs (30d)
2

Description

### Why

Our current approach is inconsistent in requiring and verifying `account_identifier.address` across stake-based operations. This can introduce ambiguity, reduce transparency for integrators, and complicate downstream processing (e.g., signers extraction, auditing, and validation). By strictly enforcing the presence of `account_identifier.address` and cross-verifying it against the required stake credential, we align with both the spec’s intent and best practices for robust integrations. For more context, check [this old PR](https://github.com/cardano-foundation/cardano-rosetta-java/pull/479#issuecomment-2981566695).

### What

- Update the construction and validation logic to always require `account_identifier.address` for any operation that affects a stake account or its state (including but not limited to registration, deregistration, delegation, and governance).
- Implement explicit cross-verification between the provided address and the associated stake credential in operation metadata. Raise an error if there is a mismatch.
- Update API and developer documentation to clearly state this enforcement and the rationale.
- Add relevant tests to guarantee consistent enforcement.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.