fix: Check blocked addresses before sending tokenize shares rewards #22718
Conversation
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
There was a problem hiding this comment.
I'm generally okay with the changes.
However, parts seem to be missing.
Could you please elaborate why the blocked addr check is not in each of these functions (on the keeper):
WithdrawSingleShareRecordReward()
WithdrawTokenizeShareRecordReward()
WithdrawAllTokenizeShareRecordReward()
x/distribution/keeper/msg_server.go
Outdated
| @@ -243,6 +243,11 @@ func (k msgServer) WithdrawTokenizeShareRecordReward(goCtx context.Context, msg | |||
| if err != nil { | |||
| return nil, err | |||
| } | |||
|
|
|||
| if k.bankKeeper.BlockedAddr(ownerAddr) { | |||
There was a problem hiding this comment.
Please consider moving this check to the WithdrawTokenizeShareRecordReward function. It contains all the validation for the procedure. It should be near the top of the function, right after fetch/unmarshal steps.
| @@ -231,6 +231,10 @@ func (k Keeper) WithdrawSingleShareRecordReward(ctx context.Context, recordID ui | |||
| } | |||
| owner := sdk.AccAddress(ownerAddr) | |||
|
|
|||
| if k.bankKeeper.BlockedAddr(owner) { | |||
There was a problem hiding this comment.
I'm a bit confused why some logic is in the msg_server and parts on the keeper? It makes more sense to me to do it all in the keeper functions.
Am I missing something here?
There was a problem hiding this comment.
i've initially put the checks right after the address is extracted. for WithdrawTokenizeShareRecordReward and WithdrawAllTokenizeShareRecordReward is in msg server (same as already existed for for CommunityPoolSpend), and here is in keeper to avoid extracting address twice but yes probably better to move it all in one place keeper or msg server. I move all in keeper as suggested (this comment is applicable to above two comments because it refers to the same thing)
| @@ -231,6 +231,10 @@ func (k Keeper) WithdrawSingleShareRecordReward(ctx context.Context, recordID ui | |||
| } | |||
| owner := sdk.AccAddress(ownerAddr) | |||
|
|
|||
| if k.bankKeeper.BlockedAddr(owner) { | |||
There was a problem hiding this comment.
@stana-miric Could you move the checks before the SendCoins calls? It will make it easier to understand later why they are necessary.
There was a problem hiding this comment.
That would do unnecessary work since there's a bunch of store access that happens before the send invocation.
What do you think about adding a comment annotation explaining why?
(Personal opinion: functions that exit as early as possible using guards are a lot easier to read and understand).
Description
Before distributing tokenized share rewards, the recipient's address must be verified. If the address is on the blocked list, the rewards should not be sent.
Author Checklist
All items are required. Please add a note to the item if the item is not applicable and
please add links to any relevant follow up issues.
I have...
!in the type prefix if API or client breaking changeCHANGELOG.mdReviewers Checklist
All items are required. Please add a note if the item is not applicable and please add
your handle next to the items reviewed if you only reviewed selected items.
Please see Pull Request Reviewer section in the contributing guide for more information on how to review a pull request.
I have...