Throw error if creating payment with negative price
kincaidoneil opened this issue · comments
If the sender passes in a negative price to the payment
method (or even 0?), Machinomy should throw an error.
In the current implementation, a negative payment effectively allows the receiver to claim the entire channel value, since in the contract, payment is an unsigned int.
Here, we sent a payment with a price of -100 units, which when it was converted to an unsigned integer overflowed to a payment value of ~2^256, allowing the receiver to claim the entire channel: https://ropsten.etherscan.io/tx/0x2c58996e62a70b337473e0dd4ab6d38a37edbd56aa8c456acb525baf5803aa47