hueso/helpix
1
0
Fork 0
Code Projects Activity

added chain ID check to avoid replay attacks

Browse Source
This commit is contained in:
hueso
2025-05-09 14:25:56 -03:00
parent d220e615e9
commit e2b44c10f6
2 changed files with 15 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
bbpay.py
View File

@@ -59,7 +59,7 @@ class Register(BBPay):
data = request.get_json()
body = {
'numeroConvenio': 701,
'nomeParticipante': data['nomeParticipante'],
'nomeParticipante': data['chainID'],
'tipoDocumento': data['tipoDocumento'],
'numeroDocumento': data['numeroDocumento'],
'numeroConta': data['numeroConta'],
@@ -116,15 +116,19 @@ class Release(BBPay):
pixTimestamp = b85decode(data['informacoesPix']['txId'])
valorSolicitacao = to_wei(data['valorSolicitacao'], 'ether')
codigoEstadoSolicitacao = data['codigoEstadoSolicitacao']
if codigoEstadoSolicitacao != 0:
if codigoEstadoSolicitacao != 1:
return 'Pix not paid', 204
response = self.oauth.get(
self.baseUrl+f"/participantes/{numeroParticipante}",
params=self.params,
verify=self.verify_ssl)
chainID = response.json()['nomeParticipante']
packed = encode_packed(['bytes32','uint80','bytes32'],
(str(numeroParticipante).encode(), int(valorSolicitacao), pixTimestamp) )
(f"{chainID}-{numeroParticipante}".encode(), int(valorSolicitacao), pixTimestamp) )
signable = eth_account.messages.encode_defunct(keccak(packed))
signature = eth_account.account.Account.sign_message(signable, private_key=getenv('PRIVATE_KEY')).signature.hex()
return {
'pixTarget': str(numeroParticipante),
'pixTarget': f"{chainID}-{numeroParticipante}",
'amount': str(valorSolicitacao),
'pixTimestamp': pixTimestamp.hex(),
'signature': signature }