As of now, we do very little to ensure that the given inputs are what we expect them to be when constructing the models. We really should be doing at least some checks with json schema or any other validation approach; not doing so results in the worst and most nefarious types of bugs for users.
Earlier, I created a transfer transaction and accidentally passed through a keypair dict as part of the owners_after
argument in the driver (rather than just a string verifying key). The driver was able to create, sign, and send this wrongly-formatted condition all the way to BigchainDB, who accepted it and wrote it onto RethinkDB (see below). Now my public/private keypair is forever visible to the world, and this condition is probably impossible to fulfill.
If I was a naive user and assumed everything had worked correctly, since nothing had told me otherwise, I might now start creating n
transactions this way without ever realizing that I've completely shot myself in the foot. Oops.
What really should've happened is me getting an error immediately upon the owners_after
signature being wrong. Crisis averted.
The persisted transaction, available in a block in RethinkDB:
{'id': '960a684bb92de50384ebf568b7e1e78d88f8afbb674872b3d25356eae77fba51',
'transaction': {'conditions': [{'cid': 0,
'condition': {'uri': {'signing_key': '4S1dzx3PSdMAfs59aBkQefPASizTs728HnhLNpYZWCad',
'verifying_key': '2dBVUoATxEzEqRdsi64AFsJnn2ywLCwnbNwW7K9BuVuS'}},
'owners_after': [{'signing_key': '4S1dzx3PSdMAfs59aBkQefPASizTs728HnhLNpYZWCad',
'verifying_key': '2dBVUoATxEzEqRdsi64AFsJnn2ywLCwnbNwW7K9BuVuS'}]}],
'data': None,
'fulfillments': [{'fid': 0,
'fulfillment': 'cf:4:4HwjqBgNkDK0fD1ajmFn0OZ75N3Jk-xIV2zlhgPxP2a7KeSZy56l5uU_Wqj6FmQz9O8xUYS3eIdR0RGDAobM4grfbtmeWbv4FXwtd5FyYbh6Azs4sle_eYFOKwsGREcL',
'input': {'cid': 0,
'txid': 'fad5ec32672b75cccf92992cc977f456bd587a7d49956fed67a227fb26d13250'},
'owners_before': ['G7J7bXF8cqSrjrxUKwcF8tCriEKC5CgyPHmtGwUi4BK3']}],
'operation': 'TRANSFER',
'timestamp': '1475228620'},
'version': 1}
Notice the condition, which lists the entire given dict:
{
...
'conditions': [{'cid': 0,
'condition': {'uri': {'signing_key': '4S1dzx3PSdMAfs59aBkQefPASizTs728HnhLNpYZWCad',
'verifying_key': '2dBVUoATxEzEqRdsi64AFsJnn2ywLCwnbNwW7K9BuVuS'}},
'owners_after': [{'signing_key': '4S1dzx3PSdMAfs59aBkQefPASizTs728HnhLNpYZWCad',
'verifying_key': '2dBVUoATxEzEqRdsi64AFsJnn2ywLCwnbNwW7K9BuVuS'}]}],
...
(In fact, I probably could've put anything there; it just so happened that it was the keypair.)
At the very least, as suggested by @sbellem, it should be made very clear (with big warning signs and all that) that whatever you give that is turned into the owners_after
is forever written in the transaction's condition. We could also add some sort of identity verification system, but that's out of scope.
cc @TimDaub @diminator