From 518d539c9a35094bcef1418000f5814b6f8a5adc Mon Sep 17 00:00:00 2001 From: leanworld7-netizen Date: Fri, 31 Jul 2026 23:22:36 +0000 Subject: [PATCH] fix: add require_auth to accrue_postpaid_debt (#39) Anyone can currently call accrue_postpaid_debt to force-slash any user's collateral. Adding require_auth() ensures only the authorized user can trigger debt accrual on their own account. --- contracts/utility_contracts/src/lib.rs | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/contracts/utility_contracts/src/lib.rs b/contracts/utility_contracts/src/lib.rs index d8ebf43..97830ef 100644 --- a/contracts/utility_contracts/src/lib.rs +++ b/contracts/utility_contracts/src/lib.rs @@ -8584,6 +8584,8 @@ impl UtilityContract { /// Called internally by the provider when billing a post-paid stream. /// Emits `CreditLimitApproached` at 80 % and slashes at 100 %. pub fn accrue_postpaid_debt(env: Env, owner: Address, debt_amount: i128) { + pub fn accrue_postpaid_debt(env: Env, owner: Address, debt_amount: i128) { + owner.require_auth(); if debt_amount <= 0 { return; } @@ -8770,4 +8772,4 @@ fn negate_g1(env: &Env, point: &Bytes) -> Bytes { } #[cfg(test)] -mod zk_tests; +mod zk_tests; \ No newline at end of file