You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
deriveOnChainId hashes UUIDs into u64 keys with no collision check, and milestone/pool keys share the escrow contract's issue_id space #609
EscrowService.deriveOnChainId FNV-1a-64-hashes the bounty/milestone/pool UUID to get the on-chain issue_id. Milestone escrows are funded on the escrow contract (until #162), in the same u64 key space as bounties keyed by real GitHub issue ids. Nothing checks for a collision with an existing on-chain escrow. A hashed key that equals a live GitHub-issue-keyed escrow makes fund fail with AlreadyFunded, or worse, after that escrow terminates, silently re-uses its key and stale contribution records (contracts #41).
Suggested fix
Namespace the keys (e.g. high bit set for derived ids), call get_escrow before funding to detect collisions, and persist the mapping.
Activity
fix(escrow): namespace derived on-chain keys with bit 63 and check co…