feat: addressed ottersec audit comments (#190)

axelarnetwork · Oct 24, 2024 · 579eda4 · 579eda4
1 parent c92873e
commit 579eda4
Show file tree

Hide file tree

Showing 5 changed files with 13 additions and 9 deletions.
diff --git a/move/its/sources/types/coin_management.move b/move/its/sources/types/coin_management.move
@@ -119,7 +119,7 @@ public(package) fun give_coin<T>(
     amount = amount + self.dust;
     self.dust = amount % self.scaling;
     let sui_amount = (amount / self.scaling as u64);
-    self.flow_limit.add_flow_out(sui_amount, clock);
+    self.flow_limit.add_flow_in(sui_amount, clock);
     if (has_capability(self)) {
         self.mint(sui_amount, ctx)
     } else {

diff --git a/move/its/sources/types/flow_limit.move b/move/its/sources/types/flow_limit.move
@@ -8,8 +8,8 @@ const EFlowLimitExceeded: u64 = 0;
 
 public struct FlowLimit has store, copy, drop {
     flow_limit: u64,
-    flow_in: u64,
-    flow_out: u64,
+    flow_in: u128,
+    flow_out: u128,
     current_epoch: u64,
 }
 
@@ -40,10 +40,10 @@ public(package) fun add_flow_in(
 
     update_epoch(self, clock);
     assert!(
-        self.flow_in + amount < self.flow_limit + self.flow_out,
+        self.flow_in + (amount as u128) < (self.flow_limit as u128) + self.flow_out,
         EFlowLimitExceeded,
     );
-    self.flow_in = self.flow_in + amount;
+    self.flow_in = self.flow_in + (amount as u128);
 }
 
 public(package) fun add_flow_out(
@@ -55,10 +55,10 @@ public(package) fun add_flow_out(
 
     update_epoch(self, clock);
     assert!(
-        self.flow_out + amount < self.flow_limit + self.flow_in,
+        self.flow_out + (amount as u128) < (self.flow_limit as u128) + self.flow_in,
         EFlowLimitExceeded,
     );
-    self.flow_out = self.flow_out + amount;
+    self.flow_out = self.flow_out + (amount as u128);
 }
 
 public(package) fun set_flow_limit(self: &mut FlowLimit, flow_limit: u64) {

diff --git a/move/its/sources/types/token_id.move b/move/its/sources/types/token_id.move
@@ -37,6 +37,7 @@ public fun from_info<T>(
     name: &String,
     symbol: &ascii::String,
     decimals: &u8,
+    remote_decimals: &u8,
     has_metadata: &bool,
     has_treasury: &bool,
 ): TokenId {
@@ -45,6 +46,7 @@ public fun from_info<T>(
     vec.append(bcs::to_bytes(name));
     vec.append(bcs::to_bytes(symbol));
     vec.append(bcs::to_bytes(decimals));
+    vec.append(bcs::to_bytes(remote_decimals));
     vec.append(bcs::to_bytes(has_metadata));
     vec.append(bcs::to_bytes(has_treasury));
     TokenId { id: address::from_bytes(keccak256(&vec)) }
@@ -58,6 +60,7 @@ public(package) fun from_coin_data<T>(
         &coin_info.name(),
         &coin_info.symbol(),
         &coin_info.decimals(),
+        &coin_info.remote_decimals(),
         &option::is_some(coin_info.metadata()),
         &coin_management.has_capability(),
     )

diff --git a/test/testdata/interface_its_flow_limit.json b/test/testdata/interface_its_flow_limit.json
@@ -14,11 +14,11 @@
         },
         {
           "name": "flow_in",
-          "type": "u64"
+          "type": "u128"
         },
         {
           "name": "flow_out",
-          "type": "u64"
+          "type": "u128"
         },
         {
           "name": "current_epoch",

diff --git a/test/testdata/interface_its_token_id.json b/test/testdata/interface_its_token_id.json
@@ -61,6 +61,7 @@
         "name#0#0": "&String",
         "symbol#0#0": "&String",
         "decimals#0#0": "&u8",
+        "remote_decimals#0#0": "&u8",
         "has_metadata#0#0": "&bool",
         "has_treasury#0#0": "&bool"
       },