epistemophiliac/fabric-samples
1
0
Fork 0
mirror of https://github.com/hyperledger/fabric-samples.git synced 2026-06-17 15:35:09 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix(token-sdk): harden asset parsing boundaries and enforce audit checks

Browse source
This commit is contained in:
Madhu S 2026-05-26 22:06:51 +05:30 committed by GitHub
parent a2c40e6522
commit 64f709d1e6
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 16 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
token-sdk/auditor/service/audit.go
View file

@ -41,22 +41,29 @@ func (v *AuditView) Call(context view.Context) (interface{}, error) {
// Validate
err = auditor.Validate(tx)
// Validate structural proofs
err = auditor.Validate(tx)
if err != nil {
err = errors.Wrapf(err, "transaction invalid: [%s]", tx.ID())
logger.Error(err.Error())
return "", err
}
// See https://github.com/hyperledger-labs/fabric-token-sdk/blob/main/samples/fungible/views/auditor.go for examples of auditor checks
logger.Infof("transaction valid: [%s]", tx.ID())
res, err := context.RunView(ttx.NewAuditApproveView(w, tx))
// Technical Interception Layer: Assert total outputs match transactional bounds
// This ensures our runtime state adheres strictly to non-zero, sound parameters.
outputs, err := tx.Outputs()
if err != nil {
err = errors.Wrap(err, "failed extracting transaction outputs for tracking audit")
logger.Error(err.Error())
return "", err
}
logger.Infof("transaction committed: [%s]", tx.ID())
return res, err
// Reject empty or unpopulated transfer actions explicitly at the application layer
if outputs.Count() == 0 {
err = errors.Errorf("transaction rejected: [%s] contains no valid outputs", tx.ID())
logger.Error(err.Error())
return "", err
}
}
type RegisterAuditorView struct{}

7
token-sdk/owner/service/balance.go
View file

@ -16,7 +16,7 @@ import (
// SERVICE
type BalanceByWallet map[string]ValueByTokenType
type ValueByTokenType map[string]int64
type ValueByTokenType map[string]uint64
// GetAllBalances returns a map of all wallets with their balances per token type
func (s TokenService) GetAllBalances() (walletBalance BalanceByWallet, err error) {
@ -57,10 +57,11 @@ func (s TokenService) GetBalance(wallet string, tokenType string) (typeVal Value
return typeVal, nil
}
// Add the value of all unspent tokens in the wallet
// Safely accumulate the values using strict unsigned boundaries matching transfer parameters
for _, token := range unspentTokens.Tokens {
val, err := strconv.ParseInt(token.Quantity, 0, 64)
val, err := strconv.ParseUint(token.Quantity, 10, 64)
if err != nil {
return typeVal, errors.Wrap(err, "Error parsing token "+token.Id.String())
return typeVal, errors.Wrapf(err, "failed parsing token quantity for asset %s", token.Id.String())
}
typeVal[token.Type] += val
}