fix: regression of smart contract sell address checks on validateTradeQuote #6081
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
Spotted in https://github.com/shapeshift/web/pull/5971/files#diff-b6f4d6672824399e71740531e3b09efe3ad3fabeb3ad6c4ce0763969f9d39ab7R210
see:
web/src/state/apis/swappers/helpers/validateTradeQuote.ts
Line 210 in 3b9b81e
vs. previous implementation:
web/src/components/MultiHopTrade/hooks/quoteValidation/useActiveQuoteStatus.tsx
Lines 47 to 53 in 6581379
This means that we effectively do not validate on the sell side anymore, but on the receive side instead, which is an extremely high-risk regression.
This however is mitigated by the fact we have a similar and correct check in-place at input step:
web/src/components/MultiHopTrade/components/TradeInput/TradeInput.tsx
Lines 209 to 216 in 255d8b7
This PR reverts to the previous behavior.
Pull Request Type
Issue (if applicable)
closes N/A, spotted while working on another PR.
Risk
high risk
tag becaue this fixes a high-risk regression.Testing
Engineering
Operations
Screenshots (if applicable)
Tested with frame-injected user smart-contract wallet address
Note
isSmartContractAddress
returns false, since we're passing the receive DOGE address instead of the smart-contract wallet on the sell side