fix(subaccount-transfer): enforce senderAddress matches localWallet (#…

…703)
dydxprotocol · Jun 20, 2024 · a43f2a3 · a43f2a3
1 parent 784194c
commit a43f2a3
Show file tree

Hide file tree

Showing 3 changed files with 14 additions and 9 deletions.
diff --git a/package.json b/package.json
@@ -47,7 +47,7 @@
     "@cosmjs/proto-signing": "^0.32.1",
     "@cosmjs/stargate": "^0.32.1",
     "@cosmjs/tendermint-rpc": "^0.32.1",
-    "@dydxprotocol/v4-abacus": "^1.7.87",
+    "@dydxprotocol/v4-abacus": "1.7.90",
     "@dydxprotocol/v4-client-js": "^1.1.20",
     "@dydxprotocol/v4-localization": "^1.1.128",
     "@ethersproject/providers": "^5.7.2",

diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
diff --git a/src/lib/abacus/dydxChainTransactions.ts b/src/lib/abacus/dydxChainTransactions.ts
@@ -552,16 +552,21 @@ class DydxChainTransactions implements AbacusDYDXChainTransactionsProtocol {
   }
 
   async subaccountTransfer(params: {
+    senderAddress: string;
     subaccountNumber: number;
     amount: string;
     destinationAddress: string;
     destinationSubaccountNumber: number;
   }): Promise<string> {
-    if (!this.compositeClient || !this.localWallet) {
-      throw new Error('Missing compositeClient or localWallet');
-    }
-
     try {
+      if (!this.compositeClient || !this.localWallet) {
+        throw new Error('Missing compositeClient or localWallet');
+      }
+
+      if (params.senderAddress !== this.localWallet.address) {
+        throw new Error('Sender address does not match local wallet');
+      }
+
       const tx = await this.compositeClient.transferToSubaccount(
         new SubaccountClient(this.localWallet, params.subaccountNumber),
         params.destinationAddress,