From be137d25ee8155a6afa3b04404b237e5b07f654d Mon Sep 17 00:00:00 2001
From: envestcc <chen1233216@hotmail.com>
Date: Tue, 3 Dec 2024 11:11:47 +0800
Subject: [PATCH] reject unprotected && unwhitelisted action

---
 action/sealedenvelope.go    | 10 ++++++++++
 api/coreservice.go          |  2 +-
 state/factory/workingset.go |  2 +-
 3 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/action/sealedenvelope.go b/action/sealedenvelope.go
index a6cd2ef64d..9a1581bd71 100644
--- a/action/sealedenvelope.go
+++ b/action/sealedenvelope.go
@@ -242,3 +242,13 @@ func (sealed *SealedEnvelope) VerifySignature() error {
 	}
 	return nil
 }
+
+// Protected says whether the transaction is replay-protected.
+func (sealed *SealedEnvelope) Protected() bool {
+	switch sealed.encoding {
+	case iotextypes.Encoding_TX_CONTAINER:
+		return sealed.Envelope.(*txContainer).tx.Protected()
+	default:
+		return sealed.encoding != iotextypes.Encoding_ETHEREUM_UNPROTECTED
+	}
+}
diff --git a/api/coreservice.go b/api/coreservice.go
index e8203aae6b..45b55dd764 100644
--- a/api/coreservice.go
+++ b/api/coreservice.go
@@ -460,7 +460,7 @@ func (core *coreService) SendAction(ctx context.Context, in *iotextypes.Action)
 		g        = core.Genesis()
 		deployer = selp.SenderAddress()
 	)
-	if selp.Encoding() == uint32(iotextypes.Encoding_ETHEREUM_UNPROTECTED) && !g.IsDeployerWhitelisted(deployer) {
+	if !selp.Protected() && !g.IsDeployerWhitelisted(deployer) {
 		return "", status.Errorf(codes.InvalidArgument, "replay deployer %v not whitelisted", deployer.Hex())
 	}
 
diff --git a/state/factory/workingset.go b/state/factory/workingset.go
index 91d46e95eb..cb28cf880a 100644
--- a/state/factory/workingset.go
+++ b/state/factory/workingset.go
@@ -194,7 +194,7 @@ func (ws *workingSet) runAction(
 	}
 	// for replay tx, check against deployer whitelist
 	g := genesis.MustExtractGenesisContext(ctx)
-	if selp.Encoding() == uint32(iotextypes.Encoding_ETHEREUM_UNPROTECTED) && !g.IsDeployerWhitelisted(selp.SenderAddress()) {
+	if !selp.Protected() && !g.IsDeployerWhitelisted(selp.SenderAddress()) {
 		return nil, errors.Wrap(errDeployerNotWhitelisted, selp.SenderAddress().String())
 	}
 	// Handle action