fix: audit (#126)

* add verify function

* fix dex single_asset_provide to use more explicit condition

* fix nft to mintable by collection object owner

* fix tests and add comments

Author: beer-1

crates/gas/src/initia_stdlib.rs

@@ -47,6 +47,7 @@ crate::macros::define_gas_parameters!(
     [crypto_ed25519_per_msg_byte_hashing: InternalGasPerByte, "crypto.ed25519.per_msg_byte_hashing", 220],
 
     [crypto_secp256k1_base: InternalGas, "crypto.secp256k1.base", 551],
+    [crypto_secp256k1_per_sig_verify: InternalGasPerArg, "crypto.secp256k1.per_sig_verify", 981492],
     [crypto_secp256k1_per_ecdsa_recover: InternalGasPerArg, "crypto.secp256k1.per_ecdsa_recover", 5918360],
     [crypto_secp256k1_per_pubkey_deserialize: InternalGasPerArg, "crypto.secp256k1.per_pubkey_deserialize", 139688],
     [crypto_secp256k1_per_sig_deserialize: InternalGasPerArg, "crypto.secp256k1.per_sig_deserialize", 1378],

crates/natives/src/crypto/secp256k1.rs

@@ -4,7 +4,9 @@ use move_vm_runtime::native_functions::NativeFunction;
 use move_vm_types::{loaded_data::runtime_types::Type, values::Value};
 
 use libsecp256k1::{
-    recover, util::MESSAGE_SIZE, util::SIGNATURE_SIZE, Message, RecoveryId, Signature,
+    recover,
+    util::{COMPRESSED_PUBLIC_KEY_SIZE, MESSAGE_SIZE, SIGNATURE_SIZE},
+    verify, Message, PublicKey, RecoveryId, Signature,
 };
 
 use smallvec::{smallvec, SmallVec};
@@ -33,6 +35,56 @@ fn read_hash(data: &[u8]) -> Result<[u8; MESSAGE_SIZE], TryFromSliceError> {
     data.try_into()
 }
 
+fn read_pubkey(data: &[u8]) -> Result<[u8; COMPRESSED_PUBLIC_KEY_SIZE], TryFromSliceError> {
+    data.try_into()
+}
+
+pub fn native_verify(
+    context: &mut SafeNativeContext,
+    _ty_args: Vec<Type>,
+    mut arguments: VecDeque<Value>,
+) -> SafeNativeResult<SmallVec<[Value; 1]>> {
+    let gas_params = &context.native_gas_params.initia_stdlib;
+    context.charge(gas_params.crypto_secp256k1_base)?;
+
+    debug_assert!(_ty_args.is_empty());
+    debug_assert!(arguments.len() == 3);
+
+    let signature = safely_pop_arg!(arguments, Vec<u8>);
+    let pubkey = safely_pop_arg!(arguments, Vec<u8>);
+    let message = safely_pop_arg!(arguments, Vec<u8>);
+
+    let msg = match read_hash(&message) {
+        Ok(mh) => Message::parse(&mh),
+        Err(_) => {
+            return Err(SafeNativeError::Abort {
+                abort_code: UNABLE_TO_DESERIALIZE,
+            });
+        }
+    };
+
+    context.charge(gas_params.crypto_secp256k1_per_pubkey_deserialize * NumArgs::one())?;
+    let pk = match read_pubkey(&pubkey) {
+        Ok(pk) => match PublicKey::parse_compressed(&pk) {
+            Ok(pk) => pk,
+            Err(_) => return Ok(smallvec![Value::bool(false)]),
+        },
+        Err(_) => return Ok(smallvec![Value::bool(false)]),
+    };
+
+    context.charge(gas_params.crypto_secp256k1_per_sig_deserialize * NumArgs::one())?;
+    let sig = match read_signature(&signature) {
+        Ok(sig) => match Signature::parse_standard(&sig) {
+            Ok(sig) => sig,
+            Err(_) => return Ok(smallvec![Value::bool(false)]),
+        },
+        Err(_) => return Ok(smallvec![Value::bool(false)]),
+    };
+
+    context.charge(gas_params.crypto_secp256k1_per_sig_verify * NumArgs::one())?;
+    Ok(smallvec![Value::bool(verify(&msg, &sig, &pk))])
+}
+
 pub fn native_recover_public_key(
     context: &mut SafeNativeContext,
     _ty_args: Vec<Type>,
@@ -102,7 +154,7 @@ pub fn native_recover_public_key(
 use rand_core::OsRng;
 
 #[cfg(feature = "testing")]
-use libsecp256k1::{sign, PublicKey, SecretKey};
+use libsecp256k1::{sign, SecretKey};
 
 #[cfg(feature = "testing")]
 pub fn native_test_only_generate_keys(
@@ -151,18 +203,18 @@ pub fn make_all(
     builder: &SafeNativeBuilder,
 ) -> impl Iterator<Item = (String, NativeFunction)> + '_ {
     let mut natives = vec![];
-    natives.extend([(
-        "recover_public_key_internal",
-        native_recover_public_key as RawSafeNative,
-    )]);
+    natives.extend([
+        ("verify_internal", native_verify as RawSafeNative),
+        ("recover_public_key_internal", native_recover_public_key),
+    ]);
 
     #[cfg(feature = "testing")]
     natives.extend([
         (
             "generate_keys",
             native_test_only_generate_keys as RawSafeNative,
         ),
-        ("sign", native_test_only_sign as RawSafeNative),
+        ("sign", native_test_only_sign),
     ]);
 
     builder.make_named_natives(natives)