Launchpad v2 audit fixes

launchpad-common/Cargo.toml

@@ -8,7 +8,7 @@ edition = "2021"
 path = "src/lib.rs"
 
 [dependencies.multiversx-sc]
-version = "0.53.0"
+version = "0.54.2"
 
 [dependencies.multiversx-sc-modules]
-version = "0.53.0"
+version = "0.54.2"

launchpad-common/src/blacklist.rs

@@ -15,6 +15,10 @@ pub trait BlacklistModule:
 
         let blacklist_mapper = self.blacklist();
         for address in users_list {
+            require!(
+                !blacklist_mapper.contains(&address),
+                "User already blacklisted"
+            );
             let confirmed_tickets_mapper = self.nr_confirmed_tickets(&address);
             let nr_confirmed_tickets = confirmed_tickets_mapper.get();
             if nr_confirmed_tickets > 0 {
@@ -32,6 +36,10 @@ pub trait BlacklistModule:
 
         let blacklist_mapper = self.blacklist();
         for address in users_list {
+            require!(
+                blacklist_mapper.contains(&address),
+                "User is not blacklisted"
+            );
             blacklist_mapper.remove(&address);
         }
     }

launchpad-common/src/tickets.rs

@@ -102,6 +102,12 @@ pub trait TicketsModule:
 
         let last_ticket_id_mapper = self.last_ticket_id();
         let first_ticket_id = last_ticket_id_mapper.get() + 1;
+
+        require!(
+            first_ticket_id < usize::MAX - nr_tickets,
+            "Maximum number of tickets was reached"
+        );
+
         let last_ticket_id = first_ticket_id + nr_tickets - 1;
 
         ticket_range_mapper.set(TicketRange {

launchpad-common/src/winner_selection.rs

@@ -36,13 +36,17 @@ pub trait WinnerSelectionModule:
         }
 
         let run_result = self.run_while_it_has_gas(|| {
+            if first_ticket_id_in_batch == last_ticket_id + 1 {
+                return STOP_OP;
+            }
+
             let current_ticket_batch_mapper = self.ticket_batch(first_ticket_id_in_batch);
             let ticket_batch: TicketBatch<Self::Api> = current_ticket_batch_mapper.get();
             let address = &ticket_batch.address;
             let nr_tickets_in_batch = ticket_batch.nr_tickets;
 
             let nr_confirmed_tickets = self.nr_confirmed_tickets(address).get();
-            if self.is_user_blacklisted(address) || nr_confirmed_tickets == 0 {
+            if nr_confirmed_tickets == 0 {
                 self.ticket_range_for_address(address).clear();
                 current_ticket_batch_mapper.clear();
             } else if nr_removed > 0 || nr_confirmed_tickets < nr_tickets_in_batch {
@@ -64,11 +68,7 @@ pub trait WinnerSelectionModule:
             nr_removed += nr_tickets_in_batch - nr_confirmed_tickets;
             first_ticket_id_in_batch += nr_tickets_in_batch;
 
-            if first_ticket_id_in_batch == last_ticket_id + 1 {
-                STOP_OP
-            } else {
-                CONTINUE_OP
-            }
+            CONTINUE_OP
         });
 
         match run_result {
@@ -104,6 +104,8 @@ pub trait WinnerSelectionModule:
         self.require_not_paused();
         self.require_winner_selection_period();
 
+        self.check_caller_owner_or_user();
+
         let flags_mapper = self.flags();
         let mut flags: Flags = flags_mapper.get();
         require!(flags.were_tickets_filtered, "Must filter tickets first");
@@ -114,6 +116,10 @@ pub trait WinnerSelectionModule:
 
         let (mut rng, mut ticket_position) = self.load_select_winners_operation();
         let run_result = self.run_while_it_has_gas(|| {
+            if nr_winning_tickets == 0 {
+                return STOP_OP;
+            }
+
             self.shuffle_single_ticket(&mut rng, ticket_position, last_ticket_position);
 
             if ticket_position == nr_winning_tickets {
@@ -193,4 +199,12 @@ pub trait WinnerSelectionModule:
 
         ticket_ids
     }
+
+    fn check_caller_owner_or_user(&self) {
+        if self.blockchain().get_owner_address() == self.blockchain().get_caller() {
+            return;
+        }
+
+        self.blockchain().check_caller_is_user_account();
+    }
 }

launchpad-guaranteed-tickets-v2/Cargo.toml

@@ -12,16 +12,16 @@ path = "src/lib.rs"
 path = "../launchpad-common"
 
 [dependencies.multiversx-sc]
-version = "0.53.0"
+version = "0.54.2"
 
 [dependencies.multiversx-sc-modules]
-version = "0.53.0"
+version = "0.54.2"
 
 [dev-dependencies]
 num-bigint = "0.4.2"
 
 [dev-dependencies.multiversx-sc-meta-lib]
-version = "0.53.0"
+version = "0.54.2"
 
 [dev-dependencies.multiversx-sc-scenario]
-version = "0.53.0"
+version = "0.54.2"

launchpad-guaranteed-tickets-v2/meta/Cargo.toml

@@ -9,7 +9,7 @@ publish = false
 path = ".."
 
 [dependencies.multiversx-sc]
-version = "0.53.0"
+version = "0.54.2"
 
 [dependencies.multiversx-sc-meta-lib]
-version = "0.53.0"
+version = "0.54.2"