Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

signTransaction should refuse to sign any txn with lease not exactly 32 bytes #692

Open
d13co opened this issue Nov 11, 2022 · 0 comments
Open
Labels
new-bug Bug report that needs triage Team Lamprey

Comments

@d13co
Copy link

d13co commented Nov 11, 2022

signTransaction should refuse to sign any txn with lease not exactly 32 bytes

Currently if you manually set a .lease field on a transaction that is not 32 bytes, algosdk will happily sign it, and when posting the transaction to algod you get At least one signature didn't pass verification

If a user needs to use the lease feature with non-app-call txn, they must add it manually, as most makeTxn methods (eg makePaymentTxnWithSuggestedParamsFromObject) do not support .lease - which could also be remedied in the future.

If was recommended on the forum that I open an issue about this.

Repro code:

    const pay = algosdk.makePaymentTxnWithSuggestedParamsFromObject({
        from: creator,
        to: creator,
        amount: 0,
        // lease here is ignored, could be improved to support it
        suggestedParams: params,
    });

    // invalid lease - must be exactly 32 bytes
    pay.lease = new Uint8Array(Buffer.from('not 32 byte=weird fail'));

    // this works but shouldn't
    const signedTx = algosdk.signTransaction(pay, recoveredAccount.sk);
    
    // this fails with "At least one signature didn't pass verification"
    let sendTx = await algodClient.sendRawTransaction(signedTx.blob).do(); 

The same code with a 32-byte lease value works as expected

Your environment

algosdk: 1.23.2
OS: Ubuntu 22.04

Steps to reproduce

  1. Use code like the provided snippet to sign & send a transaction with .lease that is set but not exactly 32 bytes in length

Expected behaviour

signTransaction refuses to sign a txn with an invalid lease field

Actual behaviour

signTransaction signs, and algod fails with a generic error message: At least one signature didn't pass verification

@d13co d13co added the new-bug Bug report that needs triage label Nov 11, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
new-bug Bug report that needs triage Team Lamprey
Projects
None yet
Development

No branches or pull requests

3 participants
@winder @d13co and others