anastasis

commit abcbf5ba681e5a65d8000bd7f8fe5c474bc01540
parent a29bd72ba3ca14ae6a4aeb5a9ea3155d7ab9abca
Author: Christian Grothoff <christian@grothoff.org>
Date:   Wed, 29 Jul 2026 17:00:31 +0200

reject IBAN transfers in a currency other than the configured one

Diffstat:
M
src/authorization/anastasis-helper-authorization-iban.c
 | 
34
++++++++++++++++++++++++++++++++++
M
src/authorization/anastasis_authorization_plugin_iban.c
 | 
27
+++++++++++++++++----------

2 files changed, 51 insertions(+), 10 deletions(-)
diff --git a/src/authorization/anastasis-helper-authorization-iban.c b/src/authorization/anastasis-helper-authorization-iban.c
@@ -51,6 +51,14 @@ static struct ANASTASIS_EUFIN_AuthenticationData auth;
 static char *authorization_iban;
 
 /**
+ * Currency this provider does business in, from "[anastasis] CURRENCY".  The
+ * database stores amounts without a currency and reads them back as this one,
+ * so a transfer in any other currency must be rejected here, while we still
+ * know what the bank actually sent.
+ */
+static char *currency;
+
+/**
  * Active request for history.
  */
 static struct ANASTASIS_EUFIN_CreditHistoryHandle *hh;
@@ -215,6 +223,7 @@ shutdown_task (void *cls)
   }
   ANASTASIS_DB_fini ();
   ANASTASIS_EUFIN_auth_free (&auth);
+  GNUNET_free (currency);
   cfg = NULL;
 }
 
@@ -281,6 +290,18 @@ history_cb (void *cls,
     hh = NULL;
     return GNUNET_SYSERR;
   }
+  if (0 != strcasecmp (currency,
+                       details->amount.currency))
+  {
+    /* The database drops the currency, so a transfer in a foreign currency
+       would be read back as if it had been made in ours.  Ignore it. */
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                "Ignoring wire transfer over %s: expected currency `%s'\n",
+                TALER_amount2s (&details->amount),
+                currency);
+    latest_row_off = serial_id;
+    return GNUNET_OK;
+  }
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Adding wire transfer over %s with (hashed) subject `%s'\n",
               TALER_amount2s (&details->amount),
@@ -406,6 +427,19 @@ run (void *cls,
     ANASTASIS_DB_fini ();
     return;
   }
+  if (GNUNET_OK !=
+      GNUNET_CONFIGURATION_get_value_string (cfg,
+                                             "anastasis",
+                                             "CURRENCY",
+                                             &currency))
+  {
+    GNUNET_log_config_missing (GNUNET_ERROR_TYPE_ERROR,
+                               "anastasis",
+                               "CURRENCY");
+    global_ret = EXIT_NOTCONFIGURED;
+    ANASTASIS_DB_fini ();
+    return;
+  }
 
   if (GNUNET_OK !=
       ANASTASIS_EUFIN_auth_parse_cfg (cfg,
diff --git a/src/authorization/anastasis_authorization_plugin_iban.c b/src/authorization/anastasis_authorization_plugin_iban.c
@@ -334,26 +334,33 @@ check_payment_ok (void *cls,
   const struct ANASTASIS_AUTHORIZATION_State *as = cls;
   struct IBAN_Context *ctx = as->ctx;
   uint64_t code;
-  struct TALER_Amount camount;
 
   if (GNUNET_OK !=
       extract_code (wire_subject,
                     &code))
     return false;
-  /* Database uses 'default' currency, but this
-     plugin may use a different currency (and the
-     same goes for the bank). So we fix this by
-     forcing the currency to be 'right'. */
-  camount = *amount;
-  strcpy (camount.currency,
-          ctx->expected_amount.currency);
+  /* The amount is read back from the database in the currency configured as
+     "[anastasis] CURRENCY", while the fee we expect comes from
+     "[authorization-iban] COST".  If those two disagree the provider is
+     misconfigured; reinterpreting one as the other (as this code used to do)
+     would let a transfer of the right magnitude in the wrong currency
+     satisfy the challenge. */
+  if (0 != strcasecmp (amount->currency,
+                       ctx->expected_amount.currency))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Received `%s', but [authorization-iban]/COST is denominated in `%s'\n",
+                amount->currency,
+                ctx->expected_amount.currency);
+    return false;
+  }
   if (1 ==
       TALER_amount_cmp (&ctx->expected_amount,
-                        &camount))
+                        amount))
   {
     GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                 "Amount `%s' insufficient for authorization\n",
-                TALER_amount2s (&camount));
+                TALER_amount2s (amount));
     return false;
   }
   return (code == as->code);