Skip to content

deriveOnChainId hashes UUIDs into u64 keys with no collision check, and milestone/pool keys share the escrow contract's issue_id space #609

Open

Description

@chonilius

Problem

EscrowService.deriveOnChainId FNV-1a-64-hashes the bounty/milestone/pool UUID to get the on-chain issue_id. Milestone escrows are funded on the escrow contract (until #162), in the same u64 key space as bounties keyed by real GitHub issue ids. Nothing checks for a collision with an existing on-chain escrow. A hashed key that equals a live GitHub-issue-keyed escrow makes fund fail with AlreadyFunded, or worse, after that escrow terminates, silently re-uses its key and stale contribution records (contracts #41).

Suggested fix

Namespace the keys (e.g. high bit set for derived ids), call get_escrow before funding to detect collisions, and persist the mapping.

Related: #158, #162

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't workingsecuritySecurity-related issue

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions