feat: on-chain collections whitelist by WaDadidou · Pull Request #1339 · TERITORI/teritori-dapp

WaDadidou · 2024-11-05T23:54:52Z

The purpose is to replace this actual Collections Whitelist handling:

Actually, the whitelisted collections are in this env variable:

teritori-dapp/.env

Line 5 in a961899

TERITORI_COLLECTION_WHITELIST=testeth-0x43cc70bf324d716782628bed38af97e4afe92f69,mumbai-0x916ad9d549907ccbbaf9ba65526826bfc3a9c0c4,testori-tori1r8raaqul4j05qtn0t05603mgquxfl8e9p7kcf7smwzcv2hc5rrlq0vket0,testori-tori1436kxs0w2es6xlqpp9rd35e3d0cjnw4sv8j3a7483sgks29jqwgsjscd88

We handle it though the backend:

teritori-dapp/go/cmd/teritori-dapp-backend/main.go

Line 40 in a961899

whitelistString = fs.String("teritori-collection-whitelist", "", "whitelist of collections to return")

New smart contract

It allows to add/remove collections addresses to an on-chain addresses list
It can query this addresses list

New indexes events

It allows to enable/disable a whitelisted flag on an item from the collections table

…dexer. Add whitelisted prop to Collection and update it by listening add/remove from cw-address-list contract

…new version, remove old script, make generate

netlify · 2024-11-05T23:55:09Z

✅ Deploy Preview for testitori ready!

Name	Link
🔨 Latest commit	`0c99b4d`
🔍 Latest deploy log	https://app.netlify.com/sites/testitori/deploys/673edf9c7e6d2c0008308276
😎 Deploy Preview	https://deploy-preview-1339--testitori.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

netlify · 2024-11-05T23:55:09Z

✅ Deploy Preview for teritori-dapp ready!

Name	Link
🔨 Latest commit	`73e91a8`
🔍 Latest deploy log	https://app.netlify.com/sites/teritori-dapp/deploys/6749f27c94f84600088d26f6
😎 Deploy Preview	https://deploy-preview-1339--teritori-dapp.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

n0izn0iz · 2024-11-10T17:28:51Z

rust/cw-contracts/cw-address-list/src/contract.rs


-        Ok(Response::default())
+        return Ok(Response::new()
+        .add_attribute("action", "add_whitelisted_collection")


keep the contract generic, it's used for the marketplace whitelist but it's actually just a list of addresses, we could use it for many other things

also the convention is to use the method name as action I believe

Suggested change

.add_attribute("action", "add_whitelisted_collection")

.add_attribute("action", "add")

Oki
842ce2b

n0izn0iz · 2024-11-10T17:29:00Z

rust/cw-contracts/cw-address-list/src/contract.rs


-        Ok(Response::default())
+        return Ok(Response::new()
+        .add_attribute("action", "remove_whitelisted_collection")


Suggested change

.add_attribute("action", "remove_whitelisted_collection")

.add_attribute("action", "remove")

n0izn0iz · 2024-11-10T17:29:24Z

rust/cw-contracts/cw-address-list/src/contract.rs

-        Ok(Response::default())
+        return Ok(Response::new()
+        .add_attribute("action", "add_whitelisted_collection")
+        .add_attribute("collection_addr", addr));


Suggested change

.add_attribute("collection_addr", addr));

.add_attribute("added_addr", addr));

n0izn0iz · 2024-11-10T17:30:26Z

rust/cw-contracts/cw-address-list/src/contract.rs

-        Ok(Response::default())
+        return Ok(Response::new()
+        .add_attribute("action", "remove_whitelisted_collection")
+        .add_attribute("collection_addr", addr));


Suggested change

.add_attribute("collection_addr", addr));

.add_attribute("removed_addr", addr));

n0izn0iz · 2024-11-10T17:33:01Z

go/internal/indexerhandler/marketplace.go

+	if execMsg.Contract != h.config.Network.VaultContractAddress {
+		return nil
+	}


this can't work, the whitelist is not the marketplace contract

there is still a problem, we should check that the contract is actually the whitelist contract, are you testing this?

you can't rely on events for security, anyone can create any event, you need to make sure you are in the correct context

also since this is supposed to be managed by a DAO, the handler should be matched also in the DAO proposal execution case

in all cases, your handlers must be restricted to only run when the execMsg.Contract is the whitelist contract

you must stat to think about how your code can be exploited, in this specific case, how the whitelist could be manipulated without being the admin. it's not only in the contract but also in the backend services

It's a big mistake, CwAdminFactory is off topic wtf sorry. I'll commit the right code

215b9ea#diff-3d7929e46442147271eabb5e05d607de0587077610f808f49aa336a603e4af28R26-R37

…act, remove useless codeId from feature, enhance script, make generate

…, make generate

n0izn0iz · 2024-11-29T08:07:18Z

packages/networks/teritori-testnet/index.ts

  idPrefix: "testori",
  testnet: true,
-  backendEndpoint: "https://dapp-backend.testnet.teritori.com",
+  backendEndpoint: "http://192.168.1.78:9090",


revert this pls

My apologies for that..
439ae84

netlify · 2024-11-29T16:48:04Z

✅ Deploy Preview for gno-dapp ready!

Name	Link
🔨 Latest commit	`73e91a8`
🔍 Latest deploy log	https://app.netlify.com/sites/gno-dapp/deploys/6749f27c8218850008d5f1ea
😎 Deploy Preview	https://deploy-preview-1339--gno-dapp.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

n0izn0iz

we should also edit the collections queries to use this new whitelist column

WaDadidou added 3 commits November 5, 2024 16:32

feat(marketplace): handle whitelisted marketplace collection using in…

68dce4e

…dexer. Add whitelisted prop to Collection and update it by listening add/remove from cw-address-list contract

fix(marketplace): fix deploy script for cw-address-list, instantiate …

731dd82

…new version, remove old script, make generate

chore(marketplace): remove old script, remove useless rule SQL

c7536b3

WaDadidou changed the title ~~feat: marketplace whitelisted collection indexer~~ feat(marketplace): handle whitelisted collection through indexer Nov 5, 2024

n0izn0iz changed the title ~~feat(marketplace): handle whitelisted collection through indexer~~ feat: on-chain collections whitelist Nov 6, 2024

Merge branch 'main' into feat-marketplace-whitelisted-collection-indexer

1c74657

WaDadidou self-assigned this Nov 7, 2024

Merge branch 'main' into feat-marketplace-whitelisted-collection-indexer

a961899

WaDadidou requested review from MikaelVallenet and n0izn0iz and removed request for MikaelVallenet and n0izn0iz November 8, 2024 00:40

n0izn0iz requested changes Nov 10, 2024

View reviewed changes

WaDadidou added 5 commits November 10, 2024 16:24

chore(marketplace): rename contract attributes and wasm actions

842ce2b

fix(marketplace): indexer: control the correct contract

5bd5388

fix(marketplace): fix indexer add/remove to/from whitelist, fix contr…

215b9ea

…act, remove useless codeId from feature, enhance script, make generate

chore(marketplace): rollback dev change, lint fix

65ad053

fix(marketplace): use events to get wasm attributes

7fc0189

WaDadidou requested a review from n0izn0iz November 11, 2024 19:20

WaDadidou and others added 4 commits November 11, 2024 20:57

chore(marketplace): add code id to NftMarketplace feature, fix script…

05643b2

…, make generate

chore(marketplace): yarn lint-fix, cargo fmt

c78df41

fix(marketplace): fix deploy cw-address-list script

f4e09b0

Merge branch 'main' into feat-marketplace-whitelisted-collection-indexer

0c99b4d

n0izn0iz requested changes Nov 29, 2024

View reviewed changes

fix: revert dev backendEndpoint

439ae84

WaDadidou requested review from n0izn0iz and removed request for n0izn0iz November 29, 2024 16:49

Merge branch 'main' into feat-marketplace-whitelisted-collection-indexer

73e91a8

n0izn0iz requested changes Nov 30, 2024

View reviewed changes

	.add_attribute("action", "add_whitelisted_collection")
	.add_attribute("action", "add")

	.add_attribute("action", "remove_whitelisted_collection")
	.add_attribute("action", "remove")

	.add_attribute("collection_addr", addr));
	.add_attribute("added_addr", addr));

	.add_attribute("collection_addr", addr));
	.add_attribute("removed_addr", addr));

Conversation

WaDadidou commented Nov 5, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

The purpose is to replace this actual Collections Whitelist handling:

New smart contract

New indexes events

Uh oh!

netlify bot commented Nov 5, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for testitori ready!

Uh oh!

netlify bot commented Nov 5, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for teritori-dapp ready!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

n0izn0iz Nov 29, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

netlify bot commented Nov 29, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for gno-dapp ready!

Uh oh!

n0izn0iz left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

WaDadidou commented Nov 5, 2024 •

edited

Loading

netlify bot commented Nov 5, 2024 •

edited

Loading

netlify bot commented Nov 5, 2024 •

edited

Loading

n0izn0iz Nov 29, 2024 •

edited

Loading

netlify bot commented Nov 29, 2024 •

edited

Loading