feat(sdk): add client-side validation to state transition construction methods#3096
Open
thepastaclaw wants to merge 10 commits intodashpay:v3.1-devfrom
Open
Conversation
Contributor
|
Warning Rate limit exceeded
⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. 📝 WalkthroughWalkthroughAdds client-side identity public-key structure validation and runtime state-transition structure validation across multiple transition types; consistently renames Changes
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
.../src/state_transition/state_transitions/identity/identity_update_transition/v0/v0_methods.rs
Outdated
Show resolved
Hide resolved
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
🧹 Nitpick comments (1)
packages/rs-dpp/src/state_transition/state_transitions/identity/identity_create_transition/v0/v0_methods.rs (1)
45-45:_platform_versionis now used — consider removing the underscore prefix.The
_prefix conventionally signals an intentionally-unused binding. Since this parameter is now actively consumed byvalidate_identity_public_keys_structure(line 64), the prefix is misleading. This applies to all three files in the PR (identity_create_transition,identity_update_transition,identity_create_from_addresses_transition).That said, this is a pre-existing naming choice inherited from the trait signature, so feel free to defer if changing it would cascade across the trait definition.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@packages/rs-dpp/src/state_transition/state_transitions/identity/identity_create_transition/v0/v0_methods.rs` at line 45, The parameter named `_platform_version` is now used by validate_identity_public_keys_structure, so remove the misleading underscore by renaming `_platform_version` to `platform_version` in the function signature in v0_methods.rs (and analogously in the other two files: identity_update_transition and identity_create_from_addresses_transition), and update all usages inside the function (including the call to validate_identity_public_keys_structure) to use the new `platform_version` identifier; if the underscore comes from a trait signature you can instead change the local binding to `platform_version` (keeping the trait name) to avoid cascading trait edits.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In
`@packages/rs-dpp/src/state_transition/state_transitions/identity/identity_create_transition/v0/v0_methods.rs`:
- Line 45: The parameter named `_platform_version` is now used by
validate_identity_public_keys_structure, so remove the misleading underscore by
renaming `_platform_version` to `platform_version` in the function signature in
v0_methods.rs (and analogously in the other two files:
identity_update_transition and identity_create_from_addresses_transition), and
update all usages inside the function (including the call to
validate_identity_public_keys_structure) to use the new `platform_version`
identifier; if the underscore comes from a trait signature you can instead
change the local binding to `platform_version` (keeping the trait name) to avoid
cascading trait edits.
Member
|
This is a test that you'll actually act on my review comment. Please just comment with "got it" :D |
Contributor
Author
|
got it :D |
shumkov
requested changes
Feb 18, 2026
| _platform_version: &PlatformVersion, | ||
| platform_version: &PlatformVersion, | ||
| _version: Option<FeatureVersion>, | ||
| ) -> Result<StateTransition, ProtocolError> { |
Collaborator
There was a problem hiding this comment.
@QuantumExplorer @lklimek do you think, guys, is it the right place to validate data in SDK when the user creates it? I just wondering if we should call the validation method in SDK methods instead + have an option to skip validation.
Contributor
There was a problem hiding this comment.
As a rule of thumb, I would say user should not be able to create an object that is invalid, unless he really tries to and knows what he's doing.
I don't see the use case for non-validated identity update transition, but if you do and you think we need it, it should be separate constructor IMO.
See https://rust-lang.github.io/api-guidelines/dependability.html#dynamic-enforcement-with-opt-out
The convention is to mark these opt-out functions with a suffix like _unchecked or by placing them in a raw submodule.
The unchecked functions can be used judiciously in cases where (1) performance dictates avoiding checks and (2) the client is otherwise confident that the inputs are valid.
Contributor
Author
There was a problem hiding this comment.
Agreed — validation by default is the right call, and the current implementation does exactly that. No use case for an unchecked path right now, but if one comes up I'll follow the _unchecked convention from the Rust API guidelines. Thanks for the reference!
Collaborator
There was a problem hiding this comment.
Ok, sounds good! I'm fine with validated only version for now. @thepastaclaw please create PRs with validation for other state transitions so we have consistent behaviour for SDK.
Contributor
Author
|
Re: @shumkov's question about validation placement: Good question. I put validation here (in the DPP method that constructs the transition) because this is the earliest point where we know all the keys and can catch the error — before any signing or serialization happens. The alternative of validating in SDK methods would work too, but would mean the raw DPP construction method silently accepts invalid key combinations that the platform will reject anyway. Happy to move it to the SDK layer with a skip-validation option if that is the preferred pattern. Deferring to @QuantumExplorer and @lklimek on the right approach. |
shumkov
previously approved these changes
Feb 18, 2026
Contributor
Author
|
Re: @shumkov's request for consistent validation: Will do! I'll create follow-up PRs adding the same client-side validation to the other state transitions for consistency across the SDK. Thanks for the review! |
thepastaclaw
added a commit
to thepastaclaw/platform
that referenced
this pull request
Feb 18, 2026
…ansitions Add client-side structure validation to 6 state transition SDK construction methods, following the pattern established in PR dashpay#3096. This ensures invalid transitions are caught early on the client side before being submitted. State transitions updated: - AddressCreditWithdrawalTransition - AddressFundingFromAssetLockTransition - AddressFundsTransferTransition - IdentityCreateFromAddressesTransition - IdentityCreditTransferToAddressesTransition - IdentityTopUpFromAddressesTransition Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
thepastaclaw
added a commit
to thepastaclaw/platform
that referenced
this pull request
Feb 18, 2026
…ansitions Add client-side structure validation to 6 state transition SDK construction methods, following the pattern established in PR dashpay#3096. This ensures invalid transitions are caught early on the client side before being submitted. State transitions updated: - AddressCreditWithdrawalTransition - AddressFundingFromAssetLockTransition - AddressFundsTransferTransition - IdentityCreateFromAddressesTransition - IdentityCreditTransferToAddressesTransition - IdentityTopUpFromAddressesTransition Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
thepastaclaw
changed the title
Contributor
|
Caution Failed to replace (edit) comment. This is likely due to insufficient permissions or the comment being deleted. Error details |
thepastaclaw
added a commit
to thepastaclaw/platform
that referenced
this pull request
Feb 20, 2026
…ansitions Add client-side structure validation to 6 state transition SDK construction methods, following the pattern established in PR dashpay#3096. This ensures invalid transitions are caught early on the client side before being submitted. State transitions updated: - AddressCreditWithdrawalTransition - AddressFundingFromAssetLockTransition - AddressFundsTransferTransition - IdentityCreateFromAddressesTransition - IdentityCreditTransferToAddressesTransition - IdentityTopUpFromAddressesTransition Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
thepastaclaw
force-pushed
the
fix/validate-transfer-key-security-level-client-side
branch
from
ef57031 to
44c71dd
Compare
thepastaclaw
added a commit
to thepastaclaw/platform
that referenced
this pull request
Feb 20, 2026
…oken transitions Add structural validation to all document and token SDK transition builders, matching the pattern from PR dashpay#3096 (identity/address transitions). Calls validate_base_structure() on BatchTransition after construction but before broadcast, catching invalid transitions early. Applied to: - Document transitions: create, delete, replace, purchase, set_price, transfer - Token builders: burn, claim, config_update, destroy, purchase, emergency_action, freeze, mint, set_price, transfer, unfreeze - Enabled dpp 'validation' feature for dash-sdk crate
This was referenced Feb 20, 2026
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
packages/rs-dpp/src/state_transition/state_transitions/address_funds/address_funds_transfer_transition/signing_tests.rs (2)
829-837:⚠️ Potential issue | 🟡 MinorTampered output value could coincide with the fee-reduced stored value.
After
ReduceOutput(0)is applied during construction the stored output is1_000_000 − fee. The tampering sets it to950_000. If the platform fee happens to equal exactly50_000credits, the two values are identical, the signable bytes are unchanged, verification succeeds, andassert!(result.is_err())would fail. Consider choosing a tampered value that is guaranteed to differ (e.g.,500_000u64or any value far from the original1_000_000), or read the actual stored output and modify it by a fixed delta.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@packages/rs-dpp/src/state_transition/state_transitions/address_funds/address_funds_transfer_transition/signing_tests.rs` around lines 829 - 837, The test uses a hardcoded tampered value that may equal the stored output after ReduceOutput(0); update the tamper logic in signing_tests.rs so the modified output is guaranteed different: either set a clearly different constant (e.g., 500_000u64) when calling transition.outputs.insert(...) or fetch the stored value for the output (from transition.outputs.get(&output) or equivalent) and change it by a fixed non-zero delta (e.g., -1 or +12345) before reinserting; keep references to the existing ReduceOutput(0) behavior and ensure verify_transition_signatures(&transition) is expected to return Err.
1012-1013:⚠️ Potential issue | 🟡 MinorMissing
else { panic!() }guards in edge-caseif letblocks.If the witness at index 0 is unexpectedly not
P2sh, bothtest_1_of_1_multisigandtest_high_threshold_multisigsilently skip thesignatures.len()assertion and pass vacuously — hiding a type-mismatch. Other P2SH tests (e.g.,test_single_p2sh_2_of_3_multisig_input_signing) correctly include anelse { panic!("Expected P2SH witness") }branch.🔧 Proposed fix for both tests
if let AddressWitness::P2sh { signatures, .. } = &transition.input_witnesses[0] { assert_eq!(signatures.len(), 1); +} else { + panic!("Expected P2SH witness"); }if let AddressWitness::P2sh { signatures, .. } = &transition.input_witnesses[0] { assert_eq!(signatures.len(), 5); +} else { + panic!("Expected P2SH witness"); }Also applies to: 1051-1053
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@packages/rs-dpp/src/state_transition/state_transitions/address_funds/address_funds_transfer_transition/signing_tests.rs` around lines 1012 - 1013, Both tests use an if let AddressWitness::P2sh { signatures, .. } = &transition.input_witnesses[0] pattern but lack an else panic branch, letting a non-P2sh witness silently skip the assertion; update the two tests (test_1_of_1_multisig and test_high_threshold_multisig) to add an else { panic!("Expected P2SH witness") } guard after the if let so the test fails loudly on a mismatched witness type, referencing the same AddressWitness::P2sh destructuring and transition.input_witnesses[0] access used now; apply the same change for the analogous block around lines 1051-1053.
🧹 Nitpick comments (2)
packages/rs-dpp/src/state_transition/state_transitions/address_funds/address_funds_transfer_transition/signing_tests.rs (1)
287-292: Extract the repeated V0 transition unwrapping into a test helper.The nested
matchthat destructuresStateTransition::AddressFundsTransfer(…::V0(v0))appears ~15 times. A small private helper eliminates the boilerplate and makes every test body easier to scan.♻️ Suggested helper
fn unwrap_transfer_v0(st: StateTransition) -> AddressFundsTransferTransitionV0 { match st { StateTransition::AddressFundsTransfer( crate::state_transition::address_funds_transfer_transition::AddressFundsTransferTransition::V0(v0), ) => v0, _ => panic!("Expected AddressFundsTransfer V0 transition"), } }Then every call site becomes:
- let transition = match state_transition { - StateTransition::AddressFundsTransfer(t) => match t { - crate::state_transition::address_funds_transfer_transition::AddressFundsTransferTransition::V0(v0) => v0, - }, - _ => panic!("Expected AddressFundsTransfer transition"), - }; + let transition = unwrap_transfer_v0(state_transition);🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@packages/rs-dpp/src/state_transition/state_transitions/address_funds/address_funds_transfer_transition/signing_tests.rs` around lines 287 - 292, The test suite repeats a nested match to extract StateTransition::AddressFundsTransfer(...::V0(v0)) about 15 times; add a small private helper fn unwrap_transfer_v0(st: StateTransition) -> AddressFundsTransferTransitionV0 that matches StateTransition::AddressFundsTransfer(crate::state_transition::address_funds_transfer_transition::AddressFundsTransferTransition::V0(v0)) => v0 and panics otherwise, then replace each repeated match in signing_tests.rs with a call to unwrap_transfer_v0(state_transition) to remove boilerplate and simplify test bodies.packages/rs-dpp/src/state_transition/state_transitions/identity/identity_create_from_addresses_transition/v0/v0_methods.rs (1)
110-116: Consider extracting the repeated validation-to-error pattern into a helper.The same 5-line block (
validate_structure→is_valid→errors.into_iter().next().unwrap()→ConsensusError) is duplicated across ~7 call sites in this PR. A small helper onValidationResult(or a free function) would reduce boilerplate and ensure consistency.Example helper
Something like (in
validation_result.rsor a utility module):impl<E: Into<ConsensusError>> ValidationResult<E> { pub fn into_result(self) -> Result<(), ProtocolError> { if self.is_valid() { Ok(()) } else { let first_error = self.errors.into_iter().next().unwrap(); Err(ProtocolError::ConsensusError(Box::new(first_error.into()))) } } }Then each call site simplifies to:
- let validation_result = - identity_create_from_addresses_transition.validate_structure(platform_version); - if !validation_result.is_valid() { - let first_error = validation_result.errors.into_iter().next().unwrap(); - return Err(ProtocolError::ConsensusError(Box::new(first_error))); - } + identity_create_from_addresses_transition + .validate_structure(platform_version) + .into_result()?;🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@packages/rs-dpp/src/state_transition/state_transitions/identity/identity_create_from_addresses_transition/v0/v0_methods.rs` around lines 110 - 116, The repeated pattern of calling validate_structure(...), checking validation_result.is_valid(), extracting the first error via validation_result.errors.into_iter().next().unwrap(), and wrapping it in ProtocolError::ConsensusError should be extracted into a helper to remove boilerplate; add a method (e.g., impl ValidationResult<E> { pub fn into_result(self) -> Result<(), ProtocolError> }) or a free utility that returns Ok(()) when is_valid() and returns Err(ProtocolError::ConsensusError(Box::new(first_error.into()))) otherwise, then replace the repeated blocks in functions like identity_create_from_addresses_transition.validate_structure(...) call sites with a single call to validation_result.into_result() (or the free helper) to ensure consistent behavior and concise code.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In
`@packages/rs-dpp/src/state_transition/state_transitions/address_funds/address_funds_transfer_transition/signing_tests.rs`:
- Line 270: Update the stale inline comment next to the inputs.insert call that
currently reads "nonce: 1, credits: 1000" to reflect the actual value passed
(1_000_000); locate the inputs.insert(input_address.clone(), (1u32,
1_000_000u64)) line and change the comment to "nonce: 1, credits: 1_000_000" (or
remove the comment if redundant).
---
Outside diff comments:
In
`@packages/rs-dpp/src/state_transition/state_transitions/address_funds/address_funds_transfer_transition/signing_tests.rs`:
- Around line 829-837: The test uses a hardcoded tampered value that may equal
the stored output after ReduceOutput(0); update the tamper logic in
signing_tests.rs so the modified output is guaranteed different: either set a
clearly different constant (e.g., 500_000u64) when calling
transition.outputs.insert(...) or fetch the stored value for the output (from
transition.outputs.get(&output) or equivalent) and change it by a fixed non-zero
delta (e.g., -1 or +12345) before reinserting; keep references to the existing
ReduceOutput(0) behavior and ensure verify_transition_signatures(&transition) is
expected to return Err.
- Around line 1012-1013: Both tests use an if let AddressWitness::P2sh {
signatures, .. } = &transition.input_witnesses[0] pattern but lack an else panic
branch, letting a non-P2sh witness silently skip the assertion; update the two
tests (test_1_of_1_multisig and test_high_threshold_multisig) to add an else {
panic!("Expected P2SH witness") } guard after the if let so the test fails
loudly on a mismatched witness type, referencing the same AddressWitness::P2sh
destructuring and transition.input_witnesses[0] access used now; apply the same
change for the analogous block around lines 1051-1053.
---
Nitpick comments:
In
`@packages/rs-dpp/src/state_transition/state_transitions/address_funds/address_funds_transfer_transition/signing_tests.rs`:
- Around line 287-292: The test suite repeats a nested match to extract
StateTransition::AddressFundsTransfer(...::V0(v0)) about 15 times; add a small
private helper fn unwrap_transfer_v0(st: StateTransition) ->
AddressFundsTransferTransitionV0 that matches
StateTransition::AddressFundsTransfer(crate::state_transition::address_funds_transfer_transition::AddressFundsTransferTransition::V0(v0))
=> v0 and panics otherwise, then replace each repeated match in signing_tests.rs
with a call to unwrap_transfer_v0(state_transition) to remove boilerplate and
simplify test bodies.
In
`@packages/rs-dpp/src/state_transition/state_transitions/identity/identity_create_from_addresses_transition/v0/v0_methods.rs`:
- Around line 110-116: The repeated pattern of calling validate_structure(...),
checking validation_result.is_valid(), extracting the first error via
validation_result.errors.into_iter().next().unwrap(), and wrapping it in
ProtocolError::ConsensusError should be extracted into a helper to remove
boilerplate; add a method (e.g., impl ValidationResult<E> { pub fn
into_result(self) -> Result<(), ProtocolError> }) or a free utility that returns
Ok(()) when is_valid() and returns
Err(ProtocolError::ConsensusError(Box::new(first_error.into()))) otherwise, then
replace the repeated blocks in functions like
identity_create_from_addresses_transition.validate_structure(...) call sites
with a single call to validation_result.into_result() (or the free helper) to
ensure consistent behavior and concise code.
| // Build inputs and outputs | ||
| let mut inputs = BTreeMap::new(); | ||
| inputs.insert(input_address.clone(), (1u32, 1000u64)); // nonce: 1, credits: 1000 | ||
| inputs.insert(input_address.clone(), (1u32, 1_000_000u64)); // nonce: 1, credits: 1000 |
Contributor
There was a problem hiding this comment.
Stale comment: credits: 1000 doesn't match the updated value 1_000_000.
The inline comment was not updated when the credit value was scaled up.
🔧 Proposed fix
- inputs.insert(input_address.clone(), (1u32, 1_000_000u64)); // nonce: 1, credits: 1000
+ inputs.insert(input_address.clone(), (1u32, 1_000_000u64)); // nonce: 1, credits: 1_000_000📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| inputs.insert(input_address.clone(), (1u32, 1_000_000u64)); // nonce: 1, credits: 1000 | |
| inputs.insert(input_address.clone(), (1u32, 1_000_000u64)); // nonce: 1, credits: 1_000_000 |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In
`@packages/rs-dpp/src/state_transition/state_transitions/address_funds/address_funds_transfer_transition/signing_tests.rs`
at line 270, Update the stale inline comment next to the inputs.insert call that
currently reads "nonce: 1, credits: 1000" to reflect the actual value passed
(1_000_000); locate the inputs.insert(input_address.clone(), (1u32,
1_000_000u64)) line and change the comment to "nonce: 1, credits: 1_000_000" (or
remove the comment if redundant).
This was referenced Feb 21, 2026
thepastaclaw
added a commit
to thepastaclaw/platform
that referenced
this pull request
Feb 21, 2026
…oken transitions Add structural validation to all document and token SDK transition builders, matching the pattern from PR dashpay#3096 (identity/address transitions). Calls validate_base_structure() on BatchTransition after construction but before broadcast, catching invalid transitions early. Applied to: - Document transitions: create, delete, replace, purchase, set_price, transfer - Token builders: burn, claim, config_update, destroy, purchase, emergency_action, freeze, mint, set_price, transfer, unfreeze - Enabled dpp 'validation' feature for dash-sdk crate
thepastaclaw
added a commit
to thepastaclaw/platform
that referenced
this pull request
Feb 21, 2026
…ansitions Add client-side structure validation to 6 state transition SDK construction methods, following the pattern established in PR dashpay#3096. This ensures invalid transitions are caught early on the client side before being submitted. State transitions updated: - AddressCreditWithdrawalTransition - AddressFundingFromAssetLockTransition - AddressFundsTransferTransition - IdentityCreateFromAddressesTransition - IdentityCreditTransferToAddressesTransition - IdentityTopUpFromAddressesTransition Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
thepastaclaw
force-pushed
the
fix/validate-transfer-key-security-level-client-side
branch
from
67ef15e to
42a8d45
Compare
thepastaclaw
added a commit
to thepastaclaw/platform
that referenced
this pull request
Feb 21, 2026
…oken transitions Add structural validation to all document and token SDK transition builders, matching the pattern from PR dashpay#3096 (identity/address transitions). Calls validate_base_structure() on BatchTransition after construction but before broadcast, catching invalid transitions early. Applied to: - Document transitions: create, delete, replace, purchase, set_price, transfer - Token builders: burn, claim, config_update, destroy, purchase, emergency_action, freeze, mint, set_price, transfer, unfreeze - Enabled dpp 'validation' feature for dash-sdk crate
…UpdateTransition Add client-side validation of public key purpose/security level compatibility in try_from_identity_with_signer() before the state transition is signed and broadcast. Previously, adding a TRANSFER key with a security level other than CRITICAL would only be rejected by the network after broadcasting. Now the validation from validate_identity_public_keys_structure() is called during transition construction, giving immediate feedback (e.g. 'Transfer keys must use CRITICAL security level') without wasting a network round-trip. This catches issues like trying to create a transfer key with HIGH or MEDIUM security level, which Platform requires to be CRITICAL.
Extend the same validate_identity_public_keys_structure() check to IdentityCreateTransition and IdentityCreateFromAddressesTransition. The previous commit only covered IdentityUpdateTransition (adding keys), but the same issue affects identity creation — e.g. creating an identity with a TRANSFER key at non-CRITICAL security level would only be rejected by the network, with no client-side feedback.
…ameter Addresses review comment: variable was previously unused but is now passed to validate_identity_public_keys_structure().
The _platform_version parameters in identity_create_transition and identity_create_from_addresses_transition are now actively used by validate_identity_public_keys_structure, so remove the underscore prefix that conventionally signals unused bindings.
…ansitions Add client-side structure validation to 6 state transition SDK construction methods, following the pattern established in PR dashpay#3096. This ensures invalid transitions are caught early on the client side before being submitted. State transitions updated: - AddressCreditWithdrawalTransition - AddressFundingFromAssetLockTransition - AddressFundsTransferTransition - IdentityCreateFromAddressesTransition - IdentityCreditTransferToAddressesTransition - IdentityTopUpFromAddressesTransition Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…cture Update signing_tests to use valid amounts (>= min thresholds), balanced input/output sums, and non-empty fee strategies. Update drive-abci structure_validation tests to use raw transition construction (bypassing client-side validation) since they intentionally test server-side rejection of invalid structures.
thepastaclaw
force-pushed
the
fix/validate-transfer-key-security-level-client-side
branch
from
42a8d45 to
46c9416
Compare
Contributor
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/identity_top_up_from_addresses/tests.rs (2)
734-799:⚠️ Potential issue | 🟡 MinorTest name says
_returns_errorbut the test assertsSuccessfulExecution.The comment on line 793 even concedes the misname. The test was apparently written to demonstrate a boundary that does not produce an error, making the name outright misleading for anyone reading the test suite.
🐛 Proposed fix
- fn test_inputs_not_exceeding_outputs_plus_min_funding_returns_error() { + fn test_inputs_exceeding_output_plus_min_funding_succeeds() {🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/identity_top_up_from_addresses/tests.rs` around lines 734 - 799, The test function named test_inputs_not_exceeding_outputs_plus_min_funding_returns_error is misnamed because it asserts a successful execution; rename the test to reflect the expected success (e.g., test_inputs_equal_outputs_plus_min_funding_succeeds or test_inputs_not_exceeding_outputs_plus_min_funding_succeeds) and update any inline comments to match the new intent; ensure the renamed function surrounding assertions (including references to create_signed_transition_with_options and AddressFundsFeeStrategyStep::DeductFromInput) keep the same logic and that the test harness will discover the new test name.
3309-3422:⚠️ Potential issue | 🟡 MinorThe test may not trigger the intended entry-removal scenario, but for a different reason than index shifting.
The implementation at
deduct_fee_from_inputs_and_outputs/v0/mod.rssafeguards against index shifting by taking a snapshot of input addresses before any mutations (line 37). Indices are resolved against this snapshot, not the mutated BTreeMap, so entry removal doesn't cause subsequent indices to shift—the protection is already built in.However, the original concern about the test's effectiveness remains valid: with
first_input ≈ 10B credits(far exceeding typical transaction fees),DeductFromInput(0)will cover the entire fee from the first address alone. This causesremaining_feeto drop to zero, triggering an early exit at the loop start (line 41). Consequently,DeductFromInput(1)is never executed as a no-op, and the second address is never charged—sosecond_finalequalssecond_remaining_before_fee, causing the assertion to fail.To test the actual entry-removal scenario,
first_inputshould be sized such that the fee exhausts (but doesn't fully consume) its contribution, leaving a remainder forDeductFromInput(1)to handle.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/identity_top_up_from_addresses/tests.rs` around lines 3309 - 3422, The test test_fee_deduction_stable_after_entry_removal is using a too-large first_input so DeductFromInput(0) covers the entire fee and DeductFromInput(1) never runs; modify the test to make first_input smaller (but not completely drained) so the first address contributes part of the fee and remaining_fee > 0 when the loop continues — adjust the first_input calculation (based on first_balance and expected fee amount) so that after the first deduction the entry is removed but there is still a remaining fee to be charged by DeductFromInput(1); this will exercise the entry-removal behavior protected by the snapshot in deduct_fee_from_inputs_and_outputs/v0/mod.rs.
🧹 Nitpick comments (4)
packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/identity_credit_transfer_to_addresses/tests.rs (1)
4921-4944: Consider a small helper to centralize manual signing and avoid hard‑coded key IDs.
This signing block repeats elsewhere and assumes key id1. A helper that derives the transfer key viaget_first_public_key_matching(...)would reduce duplication and decouple the tests from the helper’s key‑id convention.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/identity_credit_transfer_to_addresses/tests.rs` around lines 4921 - 4944, The test duplicates manual signing and hard-codes public key id 1 when building IdentityCreditTransferToAddressesTransitionV0; instead add a small helper that: given an Identity (or its public_keys) and the signer, locates the transfer key via get_first_public_key_matching(...) (or equivalent), obtains signable_bytes() from StateTransition::from(IdentityCreditTransferToAddressesTransition::V0(...)), signs via signer.sign(...) and sets transition_v0.signature, and use that helper wherever the block appears to remove the hard-coded key id and centralize signing logic (update tests creating IdentityCreditTransferToAddressesTransitionV0 to call the helper).packages/rs-dpp/src/state_transition/state_transitions/address_funds/address_funds_transfer_transition/signing_tests.rs (1)
258-1132: Consider adding a test for the newvalidate_structureerror path.This PR's core change is that
try_from_inputs_with_signernow callsvalidate_structure()and returns aProtocolError::ConsensusErroron failure. None of the existing tests exercise that branch (e.g., a mismatched input/witness count injected before signing, or a zero-output transition). A small negative-path test would close the coverage gap and guard against regressions.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@packages/rs-dpp/src/state_transition/state_transitions/address_funds/address_funds_transfer_transition/signing_tests.rs` around lines 258 - 1132, Add a negative-path unit test that calls AddressFundsTransferTransitionV0::try_from_inputs_with_signer with inputs present but an invalid outputs map (e.g., an empty outputs BTreeMap / zero-output transition) and assert it returns an Err matching ProtocolError::ConsensusError; this exercises the new validate_structure() path added to try_from_inputs_with_signer and prevents regressions. Use the existing pattern in signing_tests.rs to build a signer and inputs, pass an empty outputs map to try_from_inputs_with_signer, and assert the returned Result is Err(ProtocolError::ConsensusError(_)) (or pattern-match the consensus error) instead of expecting Ok.packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/identity_create_from_addresses/tests.rs (1)
1013-1023: Consider keeping a constructor-path helper in at least one success-path test.
*_fullmanually builds transitions and skips constructor-time validation; since this PR adds client-side validation in constructors, keeping at least one success-path test on the constructor path would preserve coverage.♻️ Example switch for one success test
- let transition = create_signed_identity_create_from_addresses_transition_full( - &identity, - &address_signer, - &identity_signer, - inputs, - None, - AddressFundsFeeStrategy::from(vec![AddressFundsFeeStrategyStep::DeductFromInput( - 0, - )]), - platform_version, - ); + let transition = create_signed_identity_create_from_addresses_transition( + &identity, + &address_signer, + &identity_signer, + inputs, + None, + Some(AddressFundsFeeStrategy::from(vec![ + AddressFundsFeeStrategyStep::DeductFromInput(0), + ])), + platform_version, + );Also applies to: 1302-1312, 1422-1432, 1521-1531, 2285-2295, 2403-2413, 2936-2946
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/identity_create_from_addresses/tests.rs` around lines 1013 - 1023, Tests currently use create_signed_identity_create_from_addresses_transition_full which bypasses constructor validation; update at least one success-path test in this file (and the other listed test ranges) to call the constructor-path helper (e.g., create_signed_identity_create_from_addresses_transition or the non-_full constructor) so the client-side validation runs. Replace one occurrence of create_signed_identity_create_from_addresses_transition_full with the standard constructor helper, supply the same arguments (identity, address_signer, identity_signer, inputs, fee strategy, platform_version) and adjust the test to assert success of the constructor/validation path instead of relying on the _full shortcut.packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/identity_top_up_from_addresses/tests.rs (1)
155-187:_platform_versionis accepted but silently ignored — consider removing the parameter.The helper deliberately constructs transitions without calling any version-aware validation, which is the right design for testing server-side rejection. But a dead parameter that is accepted at every call site (lines 304, 379, 446, 509, 574, 637, 702, 769, 838, …) and never forwarded creates confusion about whether version-specific behaviour is exercised.
♻️ Suggested cleanup
fn create_signed_transition_with_options( identity: &Identity, signer: &TestAddressSigner, inputs: BTreeMap<PlatformAddress, (AddressNonce, u64)>, output: Option<(PlatformAddress, u64)>, fee_strategy: AddressFundsFeeStrategy, user_fee_increase: u16, - _platform_version: &PlatformVersion, ) -> StateTransition {Then drop the trailing
platform_versionargument from every call site.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/identity_top_up_from_addresses/tests.rs` around lines 155 - 187, The helper function create_signed_transition_with_options currently accepts an unused _platform_version parameter; remove this parameter from its signature and from its internal argument list, and then remove the trailing platform_version argument at every call site that passes it (calls that construct IdentityTopUpFromAddressesTransition via create_signed_transition_with_options). Update any tests referencing create_signed_transition_with_options to call the function without the platform_version argument and ensure the function still returns the same StateTransition (IdentityTopUpFromAddressesTransition::V0) and signs witnesses as before.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Outside diff comments:
In
`@packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/identity_top_up_from_addresses/tests.rs`:
- Around line 734-799: The test function named
test_inputs_not_exceeding_outputs_plus_min_funding_returns_error is misnamed
because it asserts a successful execution; rename the test to reflect the
expected success (e.g., test_inputs_equal_outputs_plus_min_funding_succeeds or
test_inputs_not_exceeding_outputs_plus_min_funding_succeeds) and update any
inline comments to match the new intent; ensure the renamed function surrounding
assertions (including references to create_signed_transition_with_options and
AddressFundsFeeStrategyStep::DeductFromInput) keep the same logic and that the
test harness will discover the new test name.
- Around line 3309-3422: The test test_fee_deduction_stable_after_entry_removal
is using a too-large first_input so DeductFromInput(0) covers the entire fee and
DeductFromInput(1) never runs; modify the test to make first_input smaller (but
not completely drained) so the first address contributes part of the fee and
remaining_fee > 0 when the loop continues — adjust the first_input calculation
(based on first_balance and expected fee amount) so that after the first
deduction the entry is removed but there is still a remaining fee to be charged
by DeductFromInput(1); this will exercise the entry-removal behavior protected
by the snapshot in deduct_fee_from_inputs_and_outputs/v0/mod.rs.
---
Duplicate comments:
In
`@packages/rs-dpp/src/state_transition/state_transitions/address_funds/address_funds_transfer_transition/signing_tests.rs`:
- Line 270: Update the stale inline comment on the inputs.insert call in
signing_tests.rs: the tuple currently inserted is (1u32, 1_000_000u64) but the
trailing comment reads "// nonce: 1, credits: 1000"; change that comment to
reflect the actual value (e.g., "// nonce: 1, credits: 1_000_000") or remove it
so the comment is accurate for the inputs and input_address usage in the signing
tests.
In
`@packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/identity_credit_transfer_to_addresses/tests.rs`:
- Around line 5087-5112: Extract the repeated signing/serialization logic into a
shared test helper to reduce duplication: create a helper function (e.g.,
make_signed_identity_credit_transfer_transition) that accepts the unsigned
IdentityCreditTransferToAddressesTransitionV0 (or its fields), computes
StateTransition::from(...).signable_bytes(), looks up the transfer key from
identity.public_keys().get(&1), calls signer.sign(transfer_key,
&signable_bytes), assigns the signature to the transition, and returns the
serialized bytes (the value currently produced by the transition_bytes block);
replace the duplicated blocks with calls to this helper in tests that build and
sign IdentityCreditTransferToAddressesTransitionV0.
- Around line 5237-5261: This test repeats the pattern of creating an
IdentityCreditTransferToAddressesTransitionV0, computing signable bytes via
StateTransition::from(...).signable_bytes(), signing with
signer.sign(transfer_key, ...), assigning signature, and serializing with
serialize_to_bytes(); extract that into a shared helper (e.g.,
sign_and_serialize_identity_credit_transfer) that accepts the transition struct,
signer, and public key id or PublicKeyRef, performs signable_bytes(),
signer.sign(...), sets transition.signature, and returns the serialized bytes to
replace the duplicated sequence in the test.
---
Nitpick comments:
In
`@packages/rs-dpp/src/state_transition/state_transitions/address_funds/address_funds_transfer_transition/signing_tests.rs`:
- Around line 258-1132: Add a negative-path unit test that calls
AddressFundsTransferTransitionV0::try_from_inputs_with_signer with inputs
present but an invalid outputs map (e.g., an empty outputs BTreeMap /
zero-output transition) and assert it returns an Err matching
ProtocolError::ConsensusError; this exercises the new validate_structure() path
added to try_from_inputs_with_signer and prevents regressions. Use the existing
pattern in signing_tests.rs to build a signer and inputs, pass an empty outputs
map to try_from_inputs_with_signer, and assert the returned Result is
Err(ProtocolError::ConsensusError(_)) (or pattern-match the consensus error)
instead of expecting Ok.
In
`@packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/identity_create_from_addresses/tests.rs`:
- Around line 1013-1023: Tests currently use
create_signed_identity_create_from_addresses_transition_full which bypasses
constructor validation; update at least one success-path test in this file (and
the other listed test ranges) to call the constructor-path helper (e.g.,
create_signed_identity_create_from_addresses_transition or the non-_full
constructor) so the client-side validation runs. Replace one occurrence of
create_signed_identity_create_from_addresses_transition_full with the standard
constructor helper, supply the same arguments (identity, address_signer,
identity_signer, inputs, fee strategy, platform_version) and adjust the test to
assert success of the constructor/validation path instead of relying on the
_full shortcut.
In
`@packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/identity_credit_transfer_to_addresses/tests.rs`:
- Around line 4921-4944: The test duplicates manual signing and hard-codes
public key id 1 when building IdentityCreditTransferToAddressesTransitionV0;
instead add a small helper that: given an Identity (or its public_keys) and the
signer, locates the transfer key via get_first_public_key_matching(...) (or
equivalent), obtains signable_bytes() from
StateTransition::from(IdentityCreditTransferToAddressesTransition::V0(...)),
signs via signer.sign(...) and sets transition_v0.signature, and use that helper
wherever the block appears to remove the hard-coded key id and centralize
signing logic (update tests creating
IdentityCreditTransferToAddressesTransitionV0 to call the helper).
In
`@packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/identity_top_up_from_addresses/tests.rs`:
- Around line 155-187: The helper function create_signed_transition_with_options
currently accepts an unused _platform_version parameter; remove this parameter
from its signature and from its internal argument list, and then remove the
trailing platform_version argument at every call site that passes it (calls that
construct IdentityTopUpFromAddressesTransition via
create_signed_transition_with_options). Update any tests referencing
create_signed_transition_with_options to call the function without the
platform_version argument and ensure the function still returns the same
StateTransition (IdentityTopUpFromAddressesTransition::V0) and signs witnesses
as before.
- Add take_random_amounts_with_range_and_min_per_input to enforce min_input_amount per individual input (prevents InputBelowMinimumError) - Update all address transition constructors to use min_per_input from platform_version.dpp.state_transitions.address_funds.min_input_amount - Cap output_count in transfers so each output >= min_output_amount - Add remainder distribution to first output to prevent InputOutputBalanceMismatchError from integer division - Relax hardcoded tree structure assertions in checkpoint tests (elements count and chunk_depths) to range checks since the deterministic output changes with the new amount generation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
SDK construction methods for state transitions don't validate the transition structure before returning. Invalid transitions silently construct and broadcast, only to be rejected by the network with confusing errors.
For example:
IdentityUpdateTransition— rejected on broadcast with no clear indication whyFix
Add client-side validation calls during transition construction, before signing and broadcasting. This reuses existing validation logic from
rs-dpp(which Platform already uses server-side inrs-drive-abci).Changes in two parts:
1. Public key security level validation (originally reported by @thephez):
IdentityUpdateTransition::try_from_identity_with_signer()— validates key purpose/security level compatibilityIdentityCreateTransition::try_from_identity_with_signer()— same validationIdentityCreateFromAddressesTransition::try_from_inputs_with_signer()— same validationWhat gets validated:
2. Full
validate_structure()on remaining state transitions (per shumkov's review):AddressCreditWithdrawalTransitiontry_from_inputs_with_signerAddressFundingFromAssetLockTransitiontry_from_asset_lock_with_signerAddressFundsTransferTransitiontry_from_inputs_with_signerIdentityCreateFromAddressesTransitiontry_from_inputs_with_signerIdentityCreditTransferToAddressesTransitiontry_from_identityIdentityTopUpFromAddressesTransitiontry_from_inputs_with_signerAll use the same pattern:
Validation is placed after the transition is fully constructed (witnesses set, signatures applied) so
validate_structure()sees the complete state.Context
/cc @QuantumExplorer
Summary by CodeRabbit
Bug Fixes
Tests