Merge pull request #500 from zkLinkProtocol/fix-check-password

fix: check password before claiming

Author: xsteadybcgo

libs/red-envelope/src/red-envelope.service.ts

@@ -440,16 +440,24 @@ export class RedEnvelopeService extends ActionDto<FieldTypes> {
   public async preCheckTransaction(
     data: GenerateTransactionParams<FieldTypes>,
   ) {
-    const { additionalData } = data;
+    const { additionalData, formData } = data;
+    const { password } = formData;
     const { code, account } = additionalData;
     if (!code) {
       throw new Error('missing code');
     }
     const packetId = this.getPacketIDByCode(code);
+    const packetInfo = await this.envelopContract.redPackets(packetId);
+    const passwordHash = ethers.keccak256(ethers.toUtf8Bytes(password));
     const hasClaimed = await this.envelopContract.isClaimed(packetId, account);
     if (hasClaimed) {
       return 'User has already received';
     }
+
+    if ([...packetInfo].pop() !== passwordHash) {
+      return 'Wrong Password';
+    }
+
     const hasUnclaimedPacket =
       await this.envelopContract.getRedPacketBalance(packetId);
     if (hasUnclaimedPacket.unClaimedCount === 0n) {

libs/shared-red-packet/src/shared-red-packet.service.ts

@@ -376,19 +376,27 @@ export class SharedRedPacketService extends ActionDto<FieldTypes> {
   public async preCheckTransaction(
     data: GenerateTransactionParams<FieldTypes>,
   ) {
-    const { additionalData } = data;
+    const { additionalData, formData } = data;
+    const { password } = formData;
     const { code, account } = additionalData;
     if (!code) {
       throw new Error('missing code');
     }
     const packetId = this.getPacketIDByCode(code);
+    const packetInfo = await this.redPacketContract.redPackets(packetId);
+    const passwordHash = ethers.keccak256(ethers.toUtf8Bytes(password));
     const hasClaimed = await this.redPacketContract.isClaimed(
       packetId,
       account,
     );
     if (hasClaimed) {
       return 'User has already received';
     }
+
+    if ([...packetInfo].pop() !== passwordHash) {
+      return 'Wrong Password';
+    }
+
     const hasUnclaimedPacket =
       await this.redPacketContract.getRedPacketBalance(packetId);
     if (hasUnclaimedPacket.unClaimedCount === 0n) {