chore: validate receipt signer

Author: pcarranzav

packages/indexer-common/package.json

@@ -25,7 +25,7 @@
     "@bufbuild/protobuf": "2.2.3",
     "@graphprotocol/common-ts": "2.0.11",
     "@graphprotocol/cost-model": "0.1.18",
-    "@graphprotocol/dips-proto": "0.2.0",
+    "@graphprotocol/dips-proto": "0.2.1",
     "@grpc/grpc-js": "^1.12.6",
     "@semiotic-labs/tap-contracts-bindings": "^1.2.1",
     "@thi.ng/heaps": "1.2.38",

packages/indexer-common/src/allocations/escrow-accounts.ts

@@ -13,6 +13,14 @@ export type EscrowAccountResponse = {
   }[]
 }
 
+export type EscrowSenderResponse = {
+  signer: {
+    sender: {
+      id: string
+    }
+  }
+}
+
 export class EscrowAccounts {
   constructor(private sendersBalances: Map<Address, U256>) {}
 
@@ -65,3 +73,26 @@ export const getEscrowAccounts = async (
   }
   return EscrowAccounts.fromResponse(result.data)
 }
+
+export const getEscrowSenderForSigner = async (
+  tapSubgraph: SubgraphClient,
+  signer: Address,
+): Promise<Address> => {
+  const signerLower = signer.toLowerCase()
+  const result = await tapSubgraph.query<EscrowSenderResponse>(
+    gql`
+      query EscrowAccountQuery($signer: ID!) {
+        signer(id: $signer) {
+          sender {
+            id
+          }
+        }
+      }
+    `,
+    { signer: signerLower },
+  )
+  if (!result.data) {
+    throw `There was an error while querying Tap Subgraph. Errors: ${result.error}`
+  }
+  return toAddress(result.data.signer.sender.id)
+}

packages/indexer-common/src/indexing-fees/dips.ts

@@ -1,6 +1,7 @@
 import { formatGRT, Logger, SubgraphDeploymentID } from '@graphprotocol/common-ts'
 import {
   AllocationManager,
+  getEscrowSenderForSigner,
   GraphNode,
   IndexerManagementModels,
   IndexingDecisionBasis,
@@ -12,19 +13,19 @@ import {
 import { Op } from 'sequelize'
 
 import {
-  createDipperServiceClient,
+  createGatewayDipsServiceClient,
   createSignedCancellationRequest,
   createSignedCollectionRequest,
   decodeTapReceipt,
-} from './dipper-service-client'
+} from './gateway-dips-service-client'
 import {
   CollectPaymentStatus,
-  DipperServiceClientImpl,
+  GatewayDipsServiceClientImpl,
 } from '@graphprotocol/dips-proto/generated/gateway'
 import { IndexingAgreement } from '../indexer-management/models/indexing-agreement'
 
 export class DipsManager {
-  private dipperServiceClient: DipperServiceClientImpl
+  private gatewayDipsServiceClient: GatewayDipsServiceClientImpl
 
   constructor(
     private logger: Logger,
@@ -36,7 +37,7 @@ export class DipsManager {
     if (!this.network.specification.indexerOptions.dipperEndpoint) {
       throw new Error('dipperEndpoint is not set')
     }
-    this.dipperServiceClient = createDipperServiceClient(
+    this.gatewayDipsServiceClient = createGatewayDipsServiceClient(
       this.network.specification.indexerOptions.dipperEndpoint,
     )
   }
@@ -54,7 +55,7 @@ export class DipsManager {
           agreement.id,
           this.network.wallet,
         )
-        await this.dipperServiceClient.CancelAgreement({
+        await this.gatewayDipsServiceClient.CancelAgreement({
           version: 1,
           signedCancellation: cancellation,
         })
@@ -117,7 +118,7 @@ export class DipsManager {
       this.network.wallet,
     )
     try {
-      const response = await this.dipperServiceClient.CollectPayment({
+      const response = await this.gatewayDipsServiceClient.CollectPayment({
         version: 1,
         signedCollection: collection,
       })
@@ -130,6 +131,19 @@ export class DipsManager {
           response.tapReceipt,
           this.network.tapCollector?.tapContracts.tapVerifier.address,
         )
+        // TODO: check that the signer of the TAP receipt is a signer
+        // on the corresponding escrow account for the payer (sender) of the
+        // indexing agreement
+        const escrowSender = await getEscrowSenderForSigner(
+          this.network.tapCollector?.tapSubgraph,
+          tapReceipt.signer_address,
+        )
+        if (escrowSender !== agreement.payer) {
+          // TODO: should we cancel the agreement here?
+          throw new Error(
+            'Signer of TAP receipt is not a signer on the indexing agreement',
+          )
+        }
         await this.network.queryFeeModels.scalarTapReceipts.create(tapReceipt)
       } else {
         this.logger.error(`Error collecting payment for agreement ${agreement.id}`, {

packages/indexer-common/src/indexing-fees/dipper-service-client.ts renamed to packages/indexer-common/src/indexing-fees/gateway-dips-service-client.ts

@@ -1,6 +1,6 @@
 import { Client, credentials } from '@grpc/grpc-js'
 import { UnaryCallback } from '@grpc/grpc-js/build/src/client'
-import { DipperServiceClientImpl } from '@graphprotocol/dips-proto/generated/gateway'
+import { GatewayDipsServiceClientImpl } from '@graphprotocol/dips-proto/generated/gateway'
 import { Wallet } from 'ethers'
 import {
   _TypedDataEncoder,
@@ -156,7 +156,7 @@ export const createRpc = (url: string): Rpc => {
   return { request }
 }
 
-export const createDipperServiceClient = (url: string) => {
+export const createGatewayDipsServiceClient = (url: string) => {
   const rpc = createRpc(url)
-  return new DipperServiceClientImpl(rpc)
+  return new GatewayDipsServiceClientImpl(rpc)
 }

yarn.lock

@@ -798,10 +798,10 @@
     "@mapbox/node-pre-gyp" "1.0.11"
     cargo-cp-artifact "0.1.8"
 
-"@graphprotocol/[email protected].0":
-  version "0.2.0"
-  resolved "https://registry.yarnpkg.com/@graphprotocol/dips-proto/-/dips-proto-0.2.0.tgz#e86ceff0dd30ea8ee3b89e84b5b6ad598301ac13"
-  integrity sha512-Ppt5XZNCrdTT0PwN1UTYIoDBFS11sC4E83yxK6O6rpOHwsjaCw/bM1vwR7JOl64WC+0Jy0fEhOwWEaRBLtAxaQ==
+"@graphprotocol/[email protected].1":
+  version "0.2.1"
+  resolved "https://registry.yarnpkg.com/@graphprotocol/dips-proto/-/dips-proto-0.2.1.tgz#e65b6a8dfdefb5604da96da4eaaeb0fe096a0627"
+  integrity sha512-1+6+M7P/xsmEHPRtPX5tO6yCdCDkEvg+Owc0/GJfKpmJmFdN+hxYDvAZ4GD1drLilsyxR/iLQxEvHHQsU3FoxA==
 
 "@graphprotocol/[email protected]":
   version "0.7.1"