Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Analysis on audit "3.4 unwrap() risks" #101

Closed
wants to merge 2 commits into from

Conversation

oxarbitrage
Copy link
Contributor

I was checking all the unwrap()s we have in this codebase and i found:

  • some are unavoidable and safe to use like the ones as: https://github.com/ZcashFoundation/redjubjub/blob/main/src/batch.rs#L208-L215. Here the code will unwrap() after checking there is some value. Is the correct way for CtOption, they also have a comment XXX-jubjub: should not use CtOption here however i have no idea what is the status of that.
  • some others are safe but they need some comment.
  • some can be changed and use the ? operator instead.
  • some can be replaced with expect("some more clear message")
  • some are in tests so we don't really care.

This PR makes some changes where some improvement can be made.

The PR can have conflicts with #88 so we probably need to rebase if we consider to merge.

@oxarbitrage oxarbitrage mentioned this pull request May 15, 2021
10 tasks
src/frost.rs Show resolved Hide resolved
src/frost.rs Show resolved Hide resolved
src/lib.rs Outdated Show resolved Hide resolved
src/lib.rs Outdated Show resolved Hide resolved
src/lib.rs Outdated Show resolved Hide resolved
Copy link
Contributor

@teor2345 teor2345 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think we should return a Result from the basepoint calculation.

It's ok to panic here, because an invalid basepoint is a serious bug in the program.

Copy link
Contributor

@daira daira left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This PR should be closed; the non-test code that it's changing doesn't exist in this crate any more.

@conradoplg
Copy link
Contributor

Closing since it oudated, I opened ZcashFoundation/reddsa#61 instead

@conradoplg conradoplg closed this Apr 21, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

7 participants