Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add tests for setRevokers() method #10

Open
KimlikDAO-bot opened this issue Mar 28, 2024 · 0 comments
Open

Add tests for setRevokers() method #10

KimlikDAO-bot opened this issue Mar 28, 2024 · 0 comments
Assignees
Labels
enhancement New feature or request

Comments

@KimlikDAO-bot
Copy link
Member

KimlikDAO-bot commented Mar 28, 2024

A KPASS may include a list of revokers. Each of the revokers is given a weight and the pass itself has a revokeThreshold. If addresses with sufficient weight cast a revokeFriend() vote, the KPASS will be voided and the validators will not accept such a pass and KimlikDAO nodes will stop persisting its contents.

To be more specific, the user sets a revokeThreshold and assigns some weights to addresses of their choosing. Each time an address call the revokeFriend() method of the KPASS, the revokeThreshold of the KPASS will be decremented by the weight of the caller.

If the revokeThreshold becomes 0 or smaller, the KPASS will be invalidated.

We do not allow incrementing the revokeThreshold after the creation of the pass. This is because if a KPASS is stolen (i.e., the holder gets their wallet private keys stolen) the attacker should not be able to disable to social revoke functionality. If they can increment the revoke threshold arbitrarily, they can effectively disable the social revoke functionality.

In ab914f3, we introduced a public setRevokers() method, which should not give the attacker for a way to disable social revoke.

Think of attack vectors and write tests to ensure that the social revoke cannot be disabled even if the wallet private keys are stolen.

The tests may go into tests/KimlikDAOPassRevokeTest.sol.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Development

No branches or pull requests

2 participants