Skip to content

Commit 85e74b9

Browse files
gitmachtlgitmachtl
committed
Update 2025-08 - Enhanced Treasury Withdrawal Security
- Scripts 24a (generate vote) and 24b (query votes) is now showing also script address withdrawal addresses in the format 'stake1.../stake_test1...'. In that case also together with the script hash. This is needed for the feature below to check every script address about the proof in the metadata. - Scripts 24a (generate vote) and 24c (query votes) are doing a check on the special fields `Intersect` inserts into there TreasuryWithdrawals to improve security and find scams. This update does not check multiple withdrawal addresses if there are more than one.
1 parent a858b38 commit 85e74b9

File tree

9 files changed

+226
-162
lines changed

9 files changed

+226
-162
lines changed

‎cardano/mainnet/00_common.sh‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -201,7 +201,8 @@ case "${network,,}" in
201201
"scriptHash-ce8b37a72b178a37bbd3236daa7b2c158c9d3604e7aa667e6c6004b7": "Emurgo",
202202
"scriptHash-df0e83bde65416dade5b1f97e7f115cc1ff999550ad968850783fe50": "IOG",
203203
"scriptHash-e8165b3328027ee0d74b1f07298cb092fd99aa7697a1436f5997f625": "CJC",
204-
"scriptHash-f0dc2c00d92a45521267be2d5de1c485f6f9d14466d7e16062897cf7": "ICC"
204+
"scriptHash-f0dc2c00d92a45521267be2d5de1c485f6f9d14466d7e16062897cf7": "ICC",
205+
"scriptHash-1980dbf1ad624b0cb5410359b5ab14d008561994a6c2b6c53fabec00": "TV"
205206
}'
206207
;;
207208

‎cardano/mainnet/02_genPaymentAddrOnly.sh‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -29,8 +29,8 @@ $(basename $0) owner hw ... generates a PaymentOnly Address by usi
2929
$(basename $0) owner hwmulti ... generates a PaymentOnly Address by using a Ledger/Trezor HW-Wallet with multisig path 1854H/1815H/<Acc>/0/<Idx>
3030
3131
Optional with Hardware-Account-Numbers:
32-
$(basename $0) owner hw 1 ... generates a PaymentOnly Address by using a Leder/Trezor HW-Wallet and SubAccount #1 (Default=0)
33-
$(basename $0) owner hw 5 1 ... generates a PaymentOnly Address by using a Leder/Trezor HW-Wallet, SubAccount #5, Index #1
32+
$(basename $0) owner hw 1 ... generates a PaymentOnly Address by using a Ledger/Trezor HW-Wallet and SubAccount #1 (Default=0)
33+
$(basename $0) owner hw 5 1 ... generates a PaymentOnly Address by using a Ledger/Trezor HW-Wallet, SubAccount #5, Index #1
3434
3535
EOF
3636
exit 1;

‎cardano/mainnet/24a_genVote.sh‎

Lines changed: 53 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -627,7 +627,7 @@ do
627627
else
628628
errorMsg=$(jq -r .errorMsg <<< ${signerJSON} 2> /dev/null)
629629
echo -e "\e[0m Anchor-Data: ${iconYes}\e[32m JSONLD structure is ok\e[0m";
630-
{ read govActionTitle; read proofDepositReturnAddr; read proofWithdrawalAddr; } <<< $(jq -r '.body.title // "-", .body.onChain.depositReturnAddress // "-", .body.onChain.withdrawals[0].withdrawalAddress // "-"' ${tmpAnchorContent} 2> /dev/null)
630+
{ read govActionTitle; read proofDepositReturnAddr; read proofWithdrawalAddr; } <<< $(jq -r '.body.title // "-", .body.onChain.depositReturnAddress // "-", if (.body.onChain.withdrawals[0]) then ([.body.onChain.withdrawals[].withdrawalAddress] | add) else "-" end' ${tmpAnchorContent} 2> /dev/null)
631631
if [[ "${errorMsg}" != "" ]]; then echo -e "\e[0m Notice: ${iconNo} ${errorMsg}\e[0m"; fi
632632
authors=$(jq -r --arg iconYes "${iconYes}" --arg iconNo "${iconNo}" '.authors[] | "\\e[0m Signature: \(if .valid then $iconYes else $iconNo end) \(.name) (PubKey \(.publicKey))\\e[0m"' <<< ${signerJSON} 2> /dev/null)
633633
if [[ "${authors}" != "" ]]; then echo -e "${authors}\e[0m"; fi
@@ -660,22 +660,30 @@ do
660660

661661
echo
662662

663-
#Show deposit return stakeaddress
664-
case "${actionDepositReturnNetwork,,}${actionDepositReturnKeyType,,}" in
665-
*"scripthash") echo -e "\e[0mDeposit Return-ScriptHash:\e[32m ${actionDepositReturnHash} \e[0m\n"
663+
#Show deposit return stakeaddress
664+
case "${actionDepositReturnNetwork,,}${actionDepositReturnKeyType,,}" in
665+
666+
"mainnetkeyhash") actionDepositAddr=$(${bech32_bin} "stake" <<< "e1${actionDepositReturnHash}" 2> /dev/null);
667+
if [[ $? -ne 0 ]]; then echo -e "\n\e[35mERROR - Could not get Deposit-Return Stake-Address from KeyHash '${actionDepositReturnHash}' !\n\e[0m"; exit 1; fi
668+
echo -e "\e[0mDeposit return to\e[32m Stake-Addr \e[0m► \e[94m${actionDepositAddr}\e[0m\n"
669+
;;
670+
671+
"testnetkeyhash") actionDepositAddr=$(${bech32_bin} "stake_test" <<< "e0${actionDepositReturnHash}" 2> /dev/null);
672+
if [[ $? -ne 0 ]]; then echo -e "\n\e[35mERROR - Could not get Deposit-Return Stake-Address from KeyHash '${actionDepositReturnHash}' !\n\e[0m"; exit 1; fi
673+
echo -e "\e[0mDeposit return to\e[32m Stake-Addr \e[0m► \e[94m${actionDepositAddr}\e[0m\n"
666674
;;
667675

668-
"mainnet"*) actionDepositAddr=$(${bech32_bin} "stake" <<< "e1${actionDepositReturnHash}" 2> /dev/null);
669-
if [[ $? -ne 0 ]]; then echo -e "\n\e[35mERROR - Could not get Deposit-Return Stake-Address from Return-KeyHash '${actionDepositReturnHash}' !\n\e[0m"; exit 1; fi
670-
echo -e "\e[0mDeposit Return-StakeAddr:\e[32m ${actionDepositAddr} \e[0m\n"
676+
"mainnetscripthash") actionDepositAddr=$(${bech32_bin} "stake" <<< "f1${actionDepositReturnHash}" 2> /dev/null);
677+
if [[ $? -ne 0 ]]; then echo -e "\n\e[35mERROR - Could not get Deposit-Return Script-Address from ScriptHash '${actionDepositReturnHash}' !\n\e[0m"; exit 1; fi
678+
echo -e "\e[0mDeposit return to\e[32m ScriptAddr \e[0m► \e[94m${actionDepositAddr} \e[90m(${actionDepositReturnHash})\e[0m\n"
671679
;;
672680

673-
"testnet"*) actionDepositAddr=$(${bech32_bin} "stake_test" <<< "e0${actionDepositReturnHash}" 2> /dev/null);
674-
if [[ $? -ne 0 ]]; then echo -e "\n\e[35mERROR - Could not get Deposit-Return Stake-Address from Return-KeyHash '${actionDepositReturnHash}' !\n\e[0m"; exit 1; fi
675-
echo -e "\e[0mDeposit Return-StakeAddr:\e[32m ${actionDepositAddr} \e[0m\n"
681+
"testnetscripthash") actionDepositAddr=$(${bech32_bin} "stake_test" <<< "f0${actionDepositReturnHash}" 2> /dev/null);
682+
if [[ $? -ne 0 ]]; then echo -e "\n\e[35mERROR - Could not get Deposit-Return Script-Address from ScriptHash '${actionDepositReturnHash}' !\n\e[0m"; exit 1; fi
683+
echo -e "\e[0mDeposit return to\e[32m ScriptAddr \e[0m► \e[94m${actionDepositAddr} \e[90m(${actionDepositReturnHash})\e[0m\n"
676684
;;
677685

678-
*) echo -e "\n\e[35mERROR - Unknown network type ${actionDepositReturnNetwork} for the Deposit-Return KeyHash !\n\e[0m"; exit 1;
686+
*) echo -e "\n\e[35mERROR - Unknown network type '${actionDepositReturnNetwork}' for the Deposit-Return Key/ScriptHash '${actionDepositReturnHash}' !\n\e[0m"; exit 1;
679687
;;
680688
esac
681689

@@ -965,38 +973,46 @@ do
965973
{ read withdrawalsAmount; read withdrawalsKeyType; read withdrawalsHash; read withdrawalsNetwork; } <<< $( jq -r ".[${tmpCnt3}][1] // 0, (.[${tmpCnt3}][0].credential|keys[0]) // null, (.[${tmpCnt3}][0].credential|flatten[0]) // null, .[${tmpCnt3}][0].network // null" 2> /dev/null <<< ${withdrawalEntries})
966974
case "${withdrawalsNetwork,,}${withdrawalsKeyType,,}" in
967975

968-
*"scripthash") echo -e "\e[0mWithdrawal to\e[32m ScriptHash \e[0m► \e[94m${withdrawalsHash}\e[0m"
969-
;;
976+
"mainnetkeyhash") withdrawalsAddr=$(${bech32_bin} "stake" <<< "e1${withdrawalsHash}" 2> /dev/null);
977+
if [[ $? -ne 0 ]]; then echo -e "\n\e[35mERROR - Could not get Withdrawals Stake-Address from KeyHash '${withdrawalsHash}' !\n\e[0m"; exit 1; fi
978+
echo -e "\e[0mWithdrawal to\e[32m Stake-Addr \e[0m► \e[94m${withdrawalsAddr}\e[0m"
979+
;;
970980

971-
"mainnet"*) withdrawalsAddr=$(${bech32_bin} "stake" <<< "e1${withdrawalsHash}" 2> /dev/null);
972-
if [[ $? -ne 0 ]]; then echo -e "\n\e[35mERROR - Could not get Withdrawals Stake-Address from KeyHash '${withdrawalsHash}' !\n\e[0m"; exit 1; fi
973-
echo -e "\e[0mWithdrawal to\e[32m StakeAddr \e[0m► \e[94m${withdrawalsAddr}\e[0m"
974-
;;
981+
"testnetkeyhash") withdrawalsAddr=$(${bech32_bin} "stake_test" <<< "e0${withdrawalsHash}" 2> /dev/null);
982+
if [[ $? -ne 0 ]]; then echo -e "\n\e[35mERROR - Could not get Withdrawals Stake-Address from KeyHash '${withdrawalsHash}' !\n\e[0m"; exit 1; fi
983+
echo -e "\e[0mWithdrawal to\e[32m Stake-Addr \e[0m► \e[94m${withdrawalsAddr}\e[0m"
984+
;;
975985

976-
"testnet"*) withdrawalsAddr=$(${bech32_bin} "stake_test" <<< "e0${withdrawalsHash}" 2> /dev/null);
977-
if [[ $? -ne 0 ]]; then echo -e "\n\e[35mERROR - Could not get Withdrawals Stake-Address from KeyHash '${withdrawalsHash}' !\n\e[0m"; exit 1; fi
978-
echo -e "\e[0mWithdrawal to\e[32m StakeAddr \e[0m► \e[94m${withdrawalsAddr}\e[0m"
979-
;;
986+
"mainnetscripthash") withdrawalsAddr=$(${bech32_bin} "stake" <<< "f1${withdrawalsHash}" 2> /dev/null);
987+
if [[ $? -ne 0 ]]; then echo -e "\n\e[35mERROR - Could not get Withdrawals Script-Address from ScriptHash '${withdrawalsHash}' !\n\e[0m"; exit 1; fi
988+
echo -e "\e[0mWithdrawal to\e[32m ScriptAddr \e[0m► \e[94m${withdrawalsAddr} \e[90m(${withdrawalsHash})\e[0m"
989+
;;
980990

981-
"") echo -e "\e[0mWithdrawal \e[32mdirectly\e[0m to the \e[94mDeposit-Return-Address\n\e[0m"
982-
withdrawalsAddr="${actionDepositAddr}"
983-
;;
991+
"testnetscripthash") withdrawalsAddr=$(${bech32_bin} "stake_test" <<< "f0${withdrawalsHash}" 2> /dev/null);
992+
if [[ $? -ne 0 ]]; then echo -e "\n\e[35mERROR - Could not get Withdrawals Script-Address from ScriptHash '${withdrawalsHash}' !\n\e[0m"; exit 1; fi
993+
echo -e "\e[0mWithdrawal to\e[32m ScriptAddr \e[0m► \e[94m${withdrawalsAddr} \e[90m(${withdrawalsHash})\e[0m"
994+
;;
984995

985-
*) echo -e "\n\e[35mERROR - Unknown network type ${withdrawalsNetwork} for the Withdrawal KeyHash !\n\e[0m"; exit 1;
986-
;;
987-
esac
988-
echo -e "\e[0mWithdrawal the\e[32m Amount \e[0m► \e[94m$(convertToADA ${withdrawalsAmount}) ADA / ${withdrawalsAmount} lovelaces\e[0m"
989-
echo -e "\e[0m"
990-
done
996+
"") echo -e "\e[0mWithdrawal \e[32mdirectly\e[0m to the \e[94mDeposit-Return-Address\n\e[0m"
997+
withdrawalsAddr="${actionDepositAddr}"
998+
;;
991999

992-
#Show an alert if there is a special proof for the withdrawal address and it does not match up with the one in the action
993-
if [[ "${proofWithdrawalAddr}" != "-" ]]; then
994-
if [[ "${proofWithdrawalAddr}" == "${withdrawalsAddr}" ]]; then
995-
echo -e "\e[0m${iconYes} The Withdrawal StakeAddr in the govAction is the same as in the metadata proof!\e[0m\n";
996-
else
997-
echo -e "\e[0m${iconNo} The Withdrawal StakeAddr in the govAction is not the same as in the metadata proof!\e[0m\n";
1000+
*) echo -e "\n\e[35mERROR - Unknown network type '${withdrawalsNetwork}' for the Withdrawal KeyHash '${withdrawalsHash}' !\n\e[0m"; exit 1;
1001+
;;
1002+
1003+
esac
1004+
echo -e "\e[0mWithdrawal of the\e[32m Amount \e[0m► \e[94m$(convertToADA ${withdrawalsAmount}) ADA / ${withdrawalsAmount} lovelaces\e[0m\n"
1005+
1006+
#Show an alert if there is a special proof for the withdrawal address and it does not match up with the one in the action
1007+
if [[ "${proofWithdrawalAddr}" != "-" ]]; then
1008+
if [[ "${proofWithdrawalAddr}" == *"${withdrawalsAddr}"* ]]; then
1009+
echo -e "\e[0m${iconYes} The Withdrawal StakeAddr in the govAction is contained in the metadata proof!\e[0m\n";
1010+
else
1011+
echo -e "\e[0m${iconNo} The Withdrawal StakeAddr in the govAction is not contained in the metadata proof!\e[0m\n";
1012+
fi
9981013
fi
999-
fi
1014+
1015+
done
10001016

10011017
#Calculate acceptance: Get the right threshold, make it a nice percentage number, check if threshold is reached
10021018
{ read dRepPowerThreshold; } <<< $(jq -r '.dRepVotingThresholds.treasuryWithdrawal // 0' <<< "${protocolParametersJSON}" 2> /dev/null)

0 commit comments

Comments
 (0)