machinomy / machinomy

Node.js library for micropayments in Ether and ERC20 tokens over HTTP

Home Page:http://machinomy.com

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Throw error if creating payment with negative price

kincaidoneil opened this issue · comments

If the sender passes in a negative price to the payment method (or even 0?), Machinomy should throw an error.

In the current implementation, a negative payment effectively allows the receiver to claim the entire channel value, since in the contract, payment is an unsigned int.

Here, we sent a payment with a price of -100 units, which when it was converted to an unsigned integer overflowed to a payment value of ~2^256, allowing the receiver to claim the entire channel: https://ropsten.etherscan.io/tx/0x2c58996e62a70b337473e0dd4ab6d38a37edbd56aa8c456acb525baf5803aa47