security_test.gno

 1package game_vault
 2
 3import (
 4	"chain"
 5	"testing"
 6
 7	"gno.land/p/nt/uassert/v0"
 8)
 9
10func TestGameVaultCallerSecurity(cur realm, t *testing.T) {
11	vaultTest.Setup(cross(cur), t)
12	testing.SetOriginCaller(vaultTest.Player1)
13	testing.SetRealm(testing.NewUserRealm(vaultTest.Player1))
14	testing.SetOriginSend(chain.Coins{})
15	uassert.AbortsWithMessage(t, cur, "admin or operator access required", func() {
16		CreateRewardPool(cross(cur), "pool:unauthorized", vaultTest.GameWorldID)
17	})
18
19	processID := vaultTest.CreateEntryProcess(cross(cur), "entry:security", 10)
20	testing.SetOriginCaller(vaultTest.Player1)
21	testing.SetRealm(testing.NewCodeRealm("gno.land/r/example/vault_relay"))
22	testing.SetOriginSend(chain.Coins{{"ugnot", 10}})
23	uassert.AbortsWithMessage(t, cur, "contract calls not allowed: function must be called directly by user", func() {
24		DepositEntry(cross(cur), processID, "participant:1", "entry:relay")
25	})
26}
27
28func TestParticipationRefundExcludesCommittedAmount(cur realm, t *testing.T) {
29	vaultTest.Setup(cross(cur), t)
30	poolID := vaultTest.CreatePool(cross(cur), "pool:refund")
31	processID := vaultTest.CreateParticipationProcess(cross(cur), "participation:refund", "pool:refund", 10)
32	refundedFundID := vaultTest.DepositParticipation(cross(cur), vaultTest.Player1, processID, "participant:1", "payment:refund", 10)
33	committedFundID := vaultTest.DepositParticipation(cross(cur), vaultTest.Player1, processID, "participant:1", "payment:commit", 10)
34
35	testing.SetOriginCaller(vaultTest.Operator)
36	testing.SetRealm(testing.NewUserRealm(vaultTest.Operator))
37	testing.SetOriginSend(chain.Coins{})
38	RefundParticipationFund(cross(cur), refundedFundID, "refund:participation")
39	CloseParticipationProcess(cross(cur), processID)
40	CommitParticipationProcess(cross(cur), processID, "commit:participation")
41
42	uassert.Equal(t, int64(10), GetRewardPool(poolID).Balance)
43	uassert.Equal(t, int(ParticipationFundStatusRefunded), int(GetParticipationFundEffectiveStatus(refundedFundID)))
44	uassert.Equal(t, int(ParticipationFundStatusCommitted), int(GetParticipationFundEffectiveStatus(committedFundID)))
45	uassert.Equal(t, 1, GetVaultRefundCountByPool(poolID))
46	uassert.AbortsWithMessage(t, cur, "participation fund cannot be refunded", func() {
47		RefundParticipationFund(cross(cur), committedFundID, "refund:committed")
48	})
49}
50
51func TestSystemFundingCancellationRefundAndReplay(cur realm, t *testing.T) {
52	vaultTest.Setup(cross(cur), t)
53	poolID := vaultTest.CreatePool(cross(cur), "pool:system-refund")
54	fundingID := vaultTest.DepositSystemFunding(cross(cur), poolID, "system:refund", 20)
55
56	testing.SetOriginCaller(vaultTest.Operator)
57	testing.SetRealm(testing.NewUserRealm(vaultTest.Operator))
58	testing.SetOriginSend(chain.Coins{})
59	CancelRewardPool(cross(cur), "pool:system-refund")
60	refundID := RefundSystemFunding(cross(cur), poolID, "system:refund", "refund:system")
61
62	uassert.True(t, GetSystemFunding(fundingID).Refunded)
63	uassert.Equal(t, int64(0), GetRewardPool(poolID).Balance)
64	uassert.Equal(t, refundID, GetVaultRefundByOperationKey("refund:system").ID)
65	uassert.AbortsWithMessage(t, cur, "operation key already processed", func() {
66		RefundSystemFunding(cross(cur), poolID, "system:refund", "refund:system")
67	})
68}