Skip to content

Commit

Permalink
Update cadence/20230913-restrict-capabilities-publish.md
Browse files Browse the repository at this point in the history
Co-authored-by: Bastian Müller <[email protected]>
  • Loading branch information
bluesign and turbolent committed Oct 24, 2023
1 parent 18e6547 commit 00a8baa
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion cadence/20230913-restrict-capabilities-publish.md
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ As this shift in behavior can cause problems, this FLIP strives to address this

Before the introduction of the new controller-based capabilities API, public capabilities were guaranteed to point to storage at the same address. However, with the introduction of the API, it is now possible to obtain another account's public capability and republish it as one's own, while still maintaining the link to the other account's storage.

A lot of scenarios such as voting and gating using the proof of Non-Fungible Token (NFT) ownership, usually involve checking if an account owns a certain balance or resource by verifying the public path capability. Now, the responsibility of protection falls on the developers, which is an extra burden and holds the potential of introducing errors.
A lot of scenarios, such as voting and gating using the proof of Non-Fungible Token (NFT) ownership, usually involve checking if an account owns a certain balance or resource by verifying the public path capability. Now, the responsibility of protection falls on the developers, which is an extra burden and holds the potential of introducing bugs and security issues.

The current suggested method of defence against this issue is always checking for the `address` of the capability or the `owner` of the resource after borrowing. Unfortunately, this is an error-prone approach that developers can easily forget.

Expand Down

0 comments on commit 00a8baa

Please sign in to comment.