mirror of
https://github.com/XRPLF/rippled.git
synced 2026-07-24 07:30:30 +00:00
Fix cross-issuer MPToken authorization in AMMClawback
Commit 21cfba66fd recreated a holder's missing MPToken as authorized
for both pool assets. On a cross-issuer MPT/MPT pool this let one
issuer's clawback re-authorize the holder for the *other* issuer's
asset, bypassing its lsfMPTRequireAuth. Only auto-authorize the
recreated MPToken for the clawback issuer's own asset; recreate the
paired asset unauthorized.
This commit is contained in:
@@ -116,6 +116,7 @@ public:
|
||||
Sandbox& view,
|
||||
SLE const& ammSle,
|
||||
AccountID const account,
|
||||
std::optional<AccountID> const& clawbackIssuer,
|
||||
AccountID const& ammAccount,
|
||||
STAmount const& amountBalance,
|
||||
STAmount const& amount2Balance,
|
||||
@@ -135,6 +136,11 @@ public:
|
||||
* @param view
|
||||
* @param ammSle AMM ledger entry
|
||||
* @param ammAccount AMM account
|
||||
* @param clawbackIssuer when set (AMMClawback path), the issuer performing
|
||||
* the clawback. A recreated MPToken is only auto-authorized when the
|
||||
* asset's issuer matches this account, so a clawback cannot grant
|
||||
* authorization on behalf of a different (paired-asset) issuer.
|
||||
* @param account LP account
|
||||
* @param amountBalance current LP asset1 balance
|
||||
* @param amountWithdraw asset1 withdraw amount
|
||||
* @param amount2Withdraw asset2 withdraw amount
|
||||
@@ -150,6 +156,7 @@ public:
|
||||
Sandbox& view,
|
||||
SLE const& ammSle,
|
||||
AccountID const& ammAccount,
|
||||
std::optional<AccountID> const& clawbackIssuer,
|
||||
AccountID const& account,
|
||||
STAmount const& amountBalance,
|
||||
STAmount const& amountWithdraw,
|
||||
|
||||
Reference in New Issue
Block a user