Skip to content

fix(web): receiver snippet requires the owner's own flash-loan in the callback #144

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mattglory merged 1 commit into from
Oct 27, 2026
Merged

fix(web): receiver snippet requires the owner's own flash-loan in the callback #144

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion web/src/app/(app)/receivers/page.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -108,7 +108,9 @@ export default function ReceiversPage() {
;; only the core may call it and it repays a hardcoded core (F-10),
;; and only a loan the owner armed can run (C7). Anyone can call
;; flash-loan naming this receiver; without the arm, they could make
;; it run your strategy and spend its fee buffer.
;; it run your strategy and spend its fee buffer. The core calls back
;; without as-contract, so tx-sender is whoever called flash-loan: the
;; callback requires the owner, so nobody can front-run an armed loan.
;; Clarity 3: Clarity 4 replaces as-contract with as-contract?.
(impl-trait
'SP3TGRVG7DKGFVRTTVGGS60S59R916FWB4DAB9STZ.stx-flash-receiver-trait.stx-flash-receiver-trait)
Expand All @@ -135,6 +137,8 @@ export default function ReceiversPage() {
(begin
(asserts! (is-eq contract-caller FLASH-CORE) (err u401))
(asserts! (is-eq core FLASH-CORE) (err u401))
;; only the owner's own flash-loan can use the arm
(asserts! (is-eq tx-sender (var-get owner)) (err u403))
;; a loan the owner didn't arm stops here; the arm is single-use
(asserts! (is-eq (var-get armed) (some amount)) (err u402))
(var-set armed none)
Expand Down
6 changes: 5 additions & 1 deletion web/src/app/page.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -254,7 +254,9 @@ export default function LandingPage() {
;; only the core may call it and it repays a hardcoded core (F-10),
;; and only a loan the owner armed can run (C7). Anyone can call
;; flash-loan naming this receiver; without the arm, they could make
;; it run your strategy and spend its fee buffer.
;; it run your strategy and spend its fee buffer. The core calls back
;; without as-contract, so tx-sender is whoever called flash-loan: the
;; callback requires the owner, so nobody can front-run an armed loan.
;; Clarity 3: Clarity 4 replaces as-contract with as-contract?.
(impl-trait
'SP3TGRVG7DKGFVRTTVGGS60S59R916FWB4DAB9STZ.stx-flash-receiver-trait.stx-flash-receiver-trait)
Expand All @@ -281,6 +283,8 @@ export default function LandingPage() {
(begin
(asserts! (is-eq contract-caller FLASH-CORE) (err u401))
(asserts! (is-eq core FLASH-CORE) (err u401))
;; only the owner's own flash-loan can use the arm
(asserts! (is-eq tx-sender (var-get owner)) (err u403))
;; a loan the owner didn't arm stops here; the arm is single-use
(asserts! (is-eq (var-get armed) (some amount)) (err u402))
(var-set armed none)
Expand Down
Loading