Skip to content

fix: harden CID validation, apply artisan fee tiers correctly, and migrate platform config storage#197

Merged
Agbeleshe merged 2 commits into
Hub-of-Evolution:mainfrom
testersweb0-bug:security/cid-hardening-and-fee-tiers
Apr 27, 2026
Merged

fix: harden CID validation, apply artisan fee tiers correctly, and migrate platform config storage#197
Agbeleshe merged 2 commits into
Hub-of-Evolution:mainfrom
testersweb0-bug:security/cid-hardening-and-fee-tiers

Conversation

@testersweb0-bug
Copy link
Copy Markdown
Contributor

Description

This PR addresses one security vulnerability and two logic issues related to IPFS CID validation, fee calculation, and storage safety.


Key Changes

Hardened IPFS CIDv1 Validation (#172)

  • Strengthened validation logic to prevent malformed CID inputs
  • Added:
    • Length constraints for common multibase encodings (Base32, Base16, Base58)
    • Version prefix validation (e.g., ba for Base32 CIDv1)

Respect Artisan-Specific Fee Tiers (#170, #169)

  • Fixed issue where artisan-specific fee tiers were ignored in payout flows
  • Refactored all payout logic to use get_effective_fee_bps
  • Ensures correct fee application across:
    • Partial refunds
    • Dispute resolutions
    • General payouts

Storage Key Migration

  • Migrated platform configuration to structured storage:
    • DataKey::PlatformConfig
  • Prevents key collisions and improves maintainability

Verification Results

Automated Tests

  • test_validate_ipfs_cid_v1_stricter: PASS

  • test_validate_ipfs_cid_v1_too_short: PASS

  • test_validate_ipfs_cid_v1_wrong_version: PASS

  • test_accept_partial_refund_with_custom_fee_tier: PASS

  • test_platform_config_sanity_check: PASS

  • All baseline tests: PASS


Related Issues

Closes #170
Closes #172
Closes #169

@Agbeleshe Agbeleshe merged commit 9b73d7f into Hub-of-Evolution:main Apr 27, 2026
1 check failed
@Agbeleshe
Copy link
Copy Markdown
Contributor

LGTM!!!!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

2 participants