audit the contract

Cargo.toml

@@ -1,7 +1,7 @@
 [package]
 name = "jarvis-airdrop"
 version = "0.1.0"
-authors = ["Hiroyuki <hiroyukikumazawa.jp@gmail.com>"]
+authors = ["miracle0118 <noahsflood908@gmail.com>"]
 edition = "2021"
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html

Makefile

@@ -0,0 +1,17 @@
+build:
+	cargo wasm
+
+optimize:
+	docker run --rm -v "$$(pwd)":/code \
+		--mount type=volume,source="$$(basename "$$(pwd)")_cache",target=/code/target \
+		--mount type=volume,source=registry_cache,target=/usr/local/cargo/registry \
+		cosmwasm/rust-optimizer:0.14.0
+test:
+	cargo unit-test
+
+upload-testnet:
+	seid tx wasm store ./artifacts/raffle.wasm -y --from=dj --chain-id=atlantic-2 --node https://rpc.atlantic-2.seinetwork.io --gas=10000000 --fees=1000000usei --broadcast-mode=block
+
+instantiate-testnet:
+	seid tx wasm instantiate ${id} '{"count": 5, "owner": "sei1j7ah3st8qjr792qjwtnjmj65rqhpedjqf9dnsd"}' --chain-id atlantic-2 --from dj --gas=4000000 --fees=1000000usei --broadcast-mode=block --label raffle --no-admin --node https://rpc.atlantic-2.seinetwork.io
+

artifacts/checksums.txt

@@ -0,0 +1 @@
+385d15d7cf0b20f3681b569dfdbfc26d02270f7b0c8b620d5ed884414259532a  jarvis_airdrop.wasm

artifacts/checksums_intermediate.txt

@@ -0,0 +1 @@
+d5567d2a0638ed5a53ba728afd13da33e707ad19687e8f41b7ebe5c772291ac1  /target/wasm32-unknown-unknown/release/jarvis_airdrop.wasm

src/contract.rs

@@ -49,8 +49,6 @@ pub fn execute(
 }
 
 pub mod execute {
-    use std::ops::Sub;
-
     use super::*;
 
     pub fn increment(deps: DepsMut) -> Result<Response, ContractError> {
@@ -79,6 +77,13 @@ pub mod execute {
         info: MessageInfo,
         addr: String,
     ) -> Result<Response, ContractError> {
+        let state = STATE.load(deps.storage)?;
+
+        // Check if the sender is the owner
+        if info.sender != state.owner {
+            return Err(ContractError::Unauthorized {});
+        }
+
         // Optionally, add authorization checks here to ensure only specific addresses can update this
         let nft_contract_addr = deps.api.addr_validate(&addr)?;
         NFT_CONTRACT_ADDR.save(deps.storage, &nft_contract_addr)?;
@@ -105,7 +110,17 @@ pub mod execute {
         info: MessageInfo,
         allocations: Vec<(Addr, u32)>,
     ) -> Result<Response, ContractError> {
+        let state = STATE.load(deps.storage)?;
+
+        // Check if the sender is the owner
+        if info.sender != state.owner {
+            return Err(ContractError::Unauthorized {});
+        }
+
+        // Load and validate the NFT contract address
         let nft_contract_addr = NFT_CONTRACT_ADDR.load(deps.storage)?;
+        let validated_addr = deps.api.addr_validate(nft_contract_addr.as_str())?;
+
         let mut nfts = NFTS.load(deps.storage)?;
         let mut response = Response::new().add_attribute("action", "send_nfts");
 
@@ -119,7 +134,7 @@ pub mod execute {
                     };
 
                     let msg = CosmosMsg::Wasm(WasmMsg::Execute {
-                        contract_addr: nft_contract_addr.clone().to_string(),
+                        contract_addr: validated_addr.clone().to_string(),
                         msg: to_json_binary(&transfer_msg)?,
                         funds: vec![],
                     });