Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow withdrawer to change the authorized stake key #8456

Merged
merged 1 commit into from
Feb 26, 2020

Conversation

garious
Copy link
Contributor

@garious garious commented Feb 25, 2020

Problem

Users are likely to treat their "authorized staker" key as a hot key and keep their "authorized withdrawer" key in cold storage. If the staker key is compromised and set to a new key by an attacker, there's currently no way to use a "master" key from cold storage to reset it.

Summary of Changes

Permit the withdrawer key to change the staker key.

Note: This does not make the same change to the Vote program for two reasons:

  1. It feels less important. The stake accounts typically have more tokens than vote accounts.
  2. The Vote program has additional logic related to which epoch the was key changed in, making the patch complex enough that I got intimidated and backed out.

Fixes #8446

@codecov
Copy link

codecov bot commented Feb 26, 2020

Codecov Report

Merging #8456 into master will increase coverage by <.1%.
The diff coverage is 100%.

@@           Coverage Diff            @@
##           master   #8456     +/-   ##
========================================
+ Coverage    80.3%   80.3%   +<.1%     
========================================
  Files         254     254             
  Lines       56235   56270     +35     
========================================
+ Hits        45173   45209     +36     
+ Misses      11062   11061      -1

@garious garious added this to the Tofino v0.23.7 milestone Feb 26, 2020
Copy link
Member

@aeyakovenko aeyakovenko left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

seems ok to me

@garious garious merged commit c6a7f49 into solana-labs:master Feb 26, 2020
mergify bot pushed a commit that referenced this pull request Feb 26, 2020
mergify bot pushed a commit that referenced this pull request Feb 26, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Withdrawer key can't authorize a new staker key
2 participants