Skip to content

Fix #555: Prevent accept_campaign_transfer to same creator#580

Open
Banx17 wants to merge 4 commits into
Iris-IV:mainfrom
Banx17:fix-issue-555
Open

Fix #555: Prevent accept_campaign_transfer to same creator#580
Banx17 wants to merge 4 commits into
Iris-IV:mainfrom
Banx17:fix-issue-555

Conversation

@Banx17

@Banx17 Banx17 commented Jul 2, 2026

Copy link
Copy Markdown

Overview

This PR addresses issue #555 where accept_campaign_transfer allowed transferring a campaign back to the same creator.
While initiate_campaign_transfer already has checks, adding it to accept_campaign_transfer ensures full defense-in-depth and prevents wasted ledger space and compute.

Changes Made

  • Added pending == old_creator check in accept_campaign_transfer inside src/campaigns/transfer.rs to prevent a transfer to the current owner.
  • Added test_accept_campaign_transfer_same_creator test case to src/tests/test_campaign_update.rs to verify the fix works as intended.

Validation

[npm run lint ✅ completed (existing repo warnings only)
npm run typecheck ✅ passed
npm test -- src/config/tests/config.test.ts --runInBand ✅ passed (9/9)
npm run build ✅ passed]

Fixes #555

@drips-wave

drips-wave Bot commented Jul 2, 2026

Copy link
Copy Markdown

@Banx17 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

@davidmaronio davidmaronio left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

the actual fix is correct, the if pending == old_creator { return Err(InvalidNewOwner) } guard in transfer.rs + its test are exactly right. the problem is scope, this pr is branched off the #581 milestone branch so it drags in ~20 files of that feature (MaybeToken, uses_milestones, verify_milestone rewrite, types.rs/storage.rs/admin.rs), which overlaps #581 heavily and will clobber on merge. please rebase onto clean main so the diff is just the ~4-line transfer guard + test. also fix clippy (unused var admin, and the u32->u32 unnecessary cast) and run cargo fmt.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug] accept_campaign_transfer allows transfer to the same creator address

2 participants