From 51633f509d3df6053361855ce7e0d69c5a27759c Mon Sep 17 00:00:00 2001 From: Greg Fitzgerald Date: Wed, 11 Apr 2018 22:11:01 -0600 Subject: [PATCH] Fix test The test was meant to ensure the signature covered the 'tokens' field, but then when the 'plan' field was rolled in, Transaction::verify() started failing because Plan::verify() failed. When Transaction::verify() was split into two, the unexpected failure was exposed but went unnoticed. This patch brings it back to its original intent, to ensure signature verification fails if the network attempts to change the client's payment. --- src/transaction.rs | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/src/transaction.rs b/src/transaction.rs index 25ee6c4f2..4080d11be 100644 --- a/src/transaction.rs +++ b/src/transaction.rs @@ -167,13 +167,17 @@ mod tests { } #[test] - fn test_bad_event_signature() { + fn test_token_attack() { let zero = Hash::default(); let keypair = KeyPair::new(); let pubkey = keypair.pubkey(); let mut tr = Transaction::new(&keypair, pubkey, 42, zero); - tr.data.tokens = 1_000_000; // <-- attack! - assert!(!tr.verify_plan()); + tr.data.tokens = 1_000_000; // <-- attack, part 1! + if let Plan::Pay(ref mut payment) = tr.data.plan { + payment.tokens = tr.data.tokens; // <-- attack, part 2! + }; + assert!(tr.verify_plan()); + assert!(!tr.verify_sig()); } #[test]