-
Notifications
You must be signed in to change notification settings - Fork 242
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[ETHEREUM-CONTRACTS] Relax app registration requirement for callAppAction feature #1038
Comments
the reason we didn't do this was likely because of the possibility of calling |
There's methods giving privileged access to the host contract in various places. Some of them (host itself and agreements) are filtered out in the proposed PR. But there's also SuperToken contracts, SuperApps etc. where the host contract has privileged access, and where such a change may make it possible to maliciously impersonate the host. A cautious solution would be to create a dedicated invoker contract which does the actual call to arbitrary contracts. Alongside an operation type which provides a ctx (such that the consuming method can extract the abstracted msgSender), we can then also add an operation type omitting ctx. This would allow calls to arbitrary contract methods with arbitrary argument list. In order to keep backwards compatibility, we can't switch the existing
|
related: #1500 |
Superceded by #1895. |
To be clarified.
Notes
The text was updated successfully, but these errors were encountered: