Can I make you my token owner with default permissions?

[L-as]

It seems like I can make an account where the token id is an account with default permissions (i.e. access = None), and it would work fine? Doesn't seem problematic, but nonetheless interesting.

[L-as]

I tried it and indeed I can. I feel like access permission and permission to add children should be separated.

[L-as]

access = Signature should probably be the default. It complicates the security of token owners, since you have to be careful that they didn't exist before you started using them.
if you forget to set is_new precondition, you could run into a situation where block producer front-runs you and creates an arbitrary token account.

[MartinOndejka]

It's prevented at the o1js layer here https://github.com/o1-labs/o1js/blob/main/src/lib/mina/token/token-contract.ts#L55-L63, but it doesn't seem to work @mitschabaude.

When I create simple zkapp like this:

export class Add extends TokenContract {
  init() {
    super.init();
  }

  @method async approveBase() {
    return;
  }
}

This shouldn't work, but it does. The permissions are not set correctly.

async function localDeploy() {
  const txn = await Mina.transaction(deployerAccount, async () => {
    AccountUpdate.fundNewAccount(deployerAccount);
    zkApp.deploy();
  });

  await txn.prove();
  await txn.sign([deployerKey, zkAppPrivateKey]).send();
}

it("shouldn't work", async () => {
  await localDeploy();

  const txn = await Mina.transaction(senderAccount, async () => {
    AccountUpdate.fundNewAccount(senderAccount);

    const parent = AccountUpdate.create(zkAppAddress);

    const child = AccountUpdate.createSigned(
      senderAccount,
      zkApp.deriveTokenId()
    );

    child.balanceChange = Int64.from(69);

    parent.approve(child);
  });

  await txn.prove();
  await txn.sign([senderKey, zkAppPrivateKey]).send();

  const account = Mina.getAccount(senderAccount, zkApp.deriveTokenId());
  console.log(account.balance.toString());
});

[mitschabaude]

@MartinOndejka zkapp.deploy() is async, what if you await it?

[MartinOndejka]

@MartinOndejka zkapp.deploy() is async, what if you await it?

Yeah that was it, sneaky bug.

[MartinOndejka]

Maybe it would be worth to add no-floating-promises rule to the default eslint config.