Restrict `capabilities.publish` to account's own capabilities
Nobody has claimed this yet.
- Dominant language
- No language data
- Stars
- 26
- Forks
- 22
- PR merge metrics
- No merged PRs in 30d
Description
Currently it is possible to republish someone else's capability via new capabilities API, I think it makes sense to keep old restriction.
There are a lot of scenarios ( voting, gating with existence of NFT ) usually checking if account owns some balance or resource, by checking a public path capability. Now it will be extra burden for developers and small foot gun with this change of behaviour.
FLIP suggests adding a restriction to the capability API, permitting only capabilities from the same account address to be published via capabilities.publish.
Previous Discussion: https://github.com/onflow/cadence/issues/2768
Draft PR: https://github.com/onflow/cadence/pull/2782
FLIP Discussion: https://github.com/onflow/flips/pull/197
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the previous discussion in onflow/cadence#2768 and the linked draft PR #2782, then read FLIP PR #197 for the proposed capability restriction. Compare the current behavior with the proposal and determine whether publishing should be limited to capabilities owned by the account. Done means the proposal is resolved and the associated implementation or specification is aligned.
Written by the indexing model from the issue text.
Assessment
- Domain
- blockchain
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100