View Issue Details

IDProjectCategoryView StatusLast Update
0009185Talerexchangepublic2024-09-16 23:52
ReporterChristian Grothoff Assigned To 
PrioritynormalSeveritytweakReproducibilityN/A
Status confirmedResolutionopen 
Platformi7OSDebian GNU/LinuxOS Versionsqueeze
Product Versiongit (master) 
Target Version1.6 
Summary0009185: no signature from merchant_priv on /batch-deposit
DescriptionWith the recent KYC changes we assume that the merchant_pub signifies that the respective merchant agreed to the deposit, but actually the only signatures we (can) check are those from the coins. Now, usually the wallet should have checked that the merchant_sig under the contract is valid, but especially in the case where a wallet does a direct deposit, we cannot rely on this as obviously the wallet could put any random merchant_pub into the message signed by the coin_priv.

Thus, we need to update the protocol to have the merchant include the merchant_sig in the /batch-deposit, thus assuring us that the owner of merchant_priv did agree to the deposit.
TagsNo tags attached.

Activities

There are no notes attached to this issue.

Issue History

Date Modified Username Field Change
2024-09-11 20:01 Christian Grothoff New Issue
2024-09-11 20:01 Christian Grothoff Status new => assigned
2024-09-11 20:01 Christian Grothoff Assigned To => Christian Grothoff
2024-09-11 20:14 Christian Grothoff Assigned To Christian Grothoff => Florian Dold
2024-09-11 20:14 Christian Grothoff Status assigned => feedback
2024-09-11 20:15 Christian Grothoff Assigned To Florian Dold => Christian Grothoff
2024-09-11 20:15 Christian Grothoff Status feedback => assigned
2024-09-11 23:08 Christian Grothoff Assigned To Christian Grothoff =>
2024-09-11 23:08 Christian Grothoff Status assigned => confirmed
2024-09-15 01:30 Christian Grothoff Target Version 1.2 => 1.0 stretch goals
2024-09-16 23:52 Christian Grothoff Target Version 1.0 stretch goals => 1.6