From c6ddfa15933e63ea16ddbf2b1f2f74dc5fb387df Mon Sep 17 00:00:00 2001 From: Wilmer Paulino Date: Tue, 10 Nov 2020 12:16:43 -0800 Subject: [PATCH] account: request signature before updating account due to modification This ensures that a trader cannot progress their account state without the server acknowledging their request. --- account/manager.go | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/account/manager.go b/account/manager.go index 070b49b..f9b5ffe 100644 --- a/account/manager.go +++ b/account/manager.go @@ -1262,15 +1262,11 @@ func (m *Manager) spendAccount(ctx context.Context, account *Account, })) } - prevAccountState := account.Copy() - if err := m.cfg.Store.UpdateAccount(account, modifiers...); err != nil { - return nil, nil, err - } - - // If we require the auctioneer's signature, request it now. + // If we require the auctioneer's signature, request it now before + // updating the account on disk. if witnessType == multiSigWitness { witness, err := m.constructMultiSigWitness( - ctx, prevAccountState, spendPkg, modifiers, isClose, + ctx, account, spendPkg, modifiers, isClose, ) if err != nil { return nil, nil, err @@ -1278,6 +1274,11 @@ func (m *Manager) spendAccount(ctx context.Context, account *Account, spendPkg.tx.TxIn[spendPkg.accountInputIdx].Witness = witness } + prevAccountState := account.Copy() + if err := m.cfg.Store.UpdateAccount(account, modifiers...); err != nil { + return nil, nil, err + } + // As this is a generic account modification, we'll add some additional // information to make accounting for this transaction a bit easier. deposit := prevAccountState.Value < account.Value