Repository navigation
fix(web): receiver snippet requires the owner's own flash-loan in the callback - #144
Merged
mattglory merged 1 commit intoOct 27, 2026
Conversation
… callback Follow-up to mattglory#136, per Matt's review. The core calls execute-stx-flash without as-contract, so tx-sender is whoever called flash-loan. With only the arm check, a stranger could call flash-loan with the exact armed amount before the owner's own transaction landed. The callback now also asserts tx-sender == owner (err u403), the same check mattglory#140 added to hk-sbtc-real-receiver-v2. Checked in simnet, with the snippet extracted from both pages and pointed at the local core: before this change the stranger's front-run returned (ok true); after it, it returns (err u403). The owner's own loan still succeeds, and the arm stays single-use (err u402).
|
@unixwhisperer is attempting to deploy a commit to the matt glory's projects Team on Vercel. A member of the Team first needs to authorize it. |
unixwhisperer
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #136, as Matt asked in his review comment there.
flashstack-stx-corecallsexecute-stx-flashwithoutas-contract, so inside the callbacktx-senderis whoever calledflash-loan. With only the arm check, a stranger could callflash-loanwith the exact armed amount before the owner's own transaction landed. This adds the same check #140 added tohk-sbtc-real-receiver-v2:It's applied to both copies of the snippet (
/receiversand the landing page), along with a matching line in the snippet's header comment.Checked in simnet. I extracted the snippet from each page, pointed it at the local core and trait, and ran it in a throwaway worktree. None of this is committed.
flash-loanwith the armed amount returned(ok true). That's the front-run.(err u403), the owner's own loan returns(ok true), and a second loan gets(err u402)(the arm is single-use).