Merge pull request #140 from open-format/feature/of-335-anyone-can-re…

…ward-from-the-contract Feature/of 335 anyone can reward from the contract
open-format · Sep 26, 2024 · 6a5b228 · 6a5b228
2 parents d4d3c02 + 534de5a
commit 6a5b228
Show file tree

Hide file tree

Showing 2 changed files with 346 additions and 48 deletions.
diff --git a/src/facet/RewardsFacet.sol b/src/facet/RewardsFacet.sol
@@ -52,6 +52,10 @@ contract RewardsFacet is Multicall, SafeOwnable {
         bytes32 _activityType,
         string calldata _uri
     ) public {
+        if (msg.sender != _operator()) {
+            revert RewardsFacet_NotAuthorized();
+        }
+
         if (!_canMint(_token)) {
             revert RewardsFacet_NotAuthorized();
         }
@@ -68,6 +72,10 @@ contract RewardsFacet is Multicall, SafeOwnable {
         bytes32 _activityType,
         string calldata _uri
     ) public {
+        if (msg.sender != _operator()) {
+            revert RewardsFacet_NotAuthorized();
+        }
+
         Token(_token).transferFrom(msg.sender, _to, _amount);
         emit TokenTransferred(_token, _to, _amount, _id, _activityType, _uri);
     }
@@ -92,6 +100,10 @@ contract RewardsFacet is Multicall, SafeOwnable {
         bytes32 _activityType,
         bytes calldata _data
     ) public {
+        if (msg.sender != _operator()) {
+            revert RewardsFacet_NotAuthorized();
+        }
+
         if (!_canMint(_badgeContract)) {
             revert RewardsFacet_NotAuthorized();
         }
@@ -118,6 +130,10 @@ contract RewardsFacet is Multicall, SafeOwnable {
         bytes32 _activityType,
         bytes calldata _data
     ) public {
+        if (msg.sender != _operator()) {
+            revert RewardsFacet_NotAuthorized();
+        }
+
         if (!_canMint(_badgeContract)) {
             revert RewardsFacet_NotAuthorized();
         }
@@ -135,6 +151,10 @@ contract RewardsFacet is Multicall, SafeOwnable {
         bytes32 _activityType,
         string calldata _uri
     ) public {
+        if (msg.sender != _operator()) {
+            revert RewardsFacet_NotAuthorized();
+        }
+
         if (!_canMint(_token)) {
             revert RewardsFacet_NotAuthorized();
         }
@@ -150,10 +170,18 @@ contract RewardsFacet is Multicall, SafeOwnable {
         bytes32 _activityType,
         string calldata _uri
     ) public {
+        if (msg.sender != _operator()) {
+            revert RewardsFacet_NotAuthorized();
+        }
+
         NFT(_token).transferFrom(msg.sender, _to, _tokenId);
         emit BadgeTransferred(_token, _to, _tokenId, _id, _activityType, _uri);
     }
 
+    function _operator() internal virtual returns (address) {
+        return _owner();
+    }
+
     function _canMint(address _token) internal virtual returns (bool) {
         return Token(_token).hasRole(ADMIN_ROLE, msg.sender) || Token(_token).hasRole(MINTER_ROLE, msg.sender);
     }