[Cherrypick] Protocol update to allow recovery of stolen funds #22237 #22259
Conversation
mystenmark
temporarily deployed
to
sui-typescript-aws-kms-test-env
GitHub Actions
Inactive
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎
2 Skipped Deployments
|
mystenmark
temporarily deployed
to
sui-typescript-aws-kms-test-env
GitHub Actions
Inactive
mystenmark
force-pushed
the
address-alias-cherry-pick-1.48
branch
from
d0e84fc to
f2e0516
Compare
mystenmark
temporarily deployed
to
sui-typescript-aws-kms-test-env
GitHub Actions
Inactive
| .tx_signatures() | ||
| .iter() | ||
| .filter_map(|sig| sig.try_into().ok()) | ||
| .any(|signer: SuiAddress| { |
There was a problem hiding this comment.
| .any(|signer: SuiAddress| { | |
| .all(|signer: SuiAddress| { |
There was a problem hiding this comment.
even though there will be only a single signer, probably worth checking all vs any?
There was a problem hiding this comment.
you're not wrong, but in the interests of getting this landed lets leave it. the important thing is that the attacker can't bypass the deny list
| /// For each pair, `aliased` is allowed to act as `original` for any of the transaction digests | ||
| /// listed in `tx_digests` | ||
| #[serde(skip_serializing_if = "Vec::is_empty")] | ||
| aliased_addresses: Vec<AliasedAddress>, |
There was a problem hiding this comment.
one, maybe minor concern, is that we have our read infrastructure which expects the values for each protocol config to be a string vs a complex datastructure per the ProtocolConfigValue enum. do we know how this will interact with attr_map?
There was a problem hiding this comment.
um, no, i don't know. i would say any read infra should just ignore this field if that's easy to do?
There was a problem hiding this comment.
theres a few places that do a pattern match against ProtocolConfigValue so i'd expect we may be able to ignore it there (and should show up in compilation...)
mystenmark
merged commit 822bae4
into
releases/sui-v1.48.0-release
This patch enables the execution of two recovery transactions, transferring stolen funds from the attacker addresses to
0xa165cf7f150f34375b3943ccc66edd52de8561191ec7d663ec32fb836f078544a Cetus multi-sig wallet with Cetus, the Sui Foundation, and OtterSec acting as signers.The two transactions can be found below and can be inspected leveraging https://multisig-toolkit.mystenlabs.com/offline-signer.
Recovery Transaction 1
Address:
0xcd8962dad278d8b50fa0f9eb0186bfa4cbdecc6d59377214c88d0286a0ac9562Transaction Digest:
B2eGLFoMHgj93Ni8dAJBfqGzo8EWSTLBesZzhEpTPA4Base64 Encoded BCS of the Transaction:
Recovery Transaction 2
Address:
0xe28b50cef1d633ea43d3296a3f6b67ff0312a5f1a99f0af753c85b8b5de8ff06Transaction Digest:
J4QqSAgp7VrQtQpMy5wDX4QGsCSEZu3U5KuDAkbESAgeBase64 Encoded BCS of the Transaction:
Release notes
Check each box that your changes affect. If none of the boxes relate to your changes, release notes aren't required.
For each box you select, include information after the relevant heading that describes the impact of your changes that a user might notice and any actions they must take to implement updates.