fix: also validate tx-sender in auth check

hstove · hstove · commit 25c2b1428134 · 2025-07-16T10:15:49.000-07:00
diff --git a/stackslib/src/chainstate/stacks/boot/sip-031.clar b/stackslib/src/chainstate/stacks/boot/sip-031.clar
@@ -71,7 +71,10 @@
 )
 
 (define-private (validate-caller)
-    (ok (asserts! (is-eq contract-caller (var-get recipient)) (err ERR_NOT_ALLOWED)))
+    (begin
+        (asserts! (is-eq contract-caller (var-get recipient)) (err ERR_NOT_ALLOWED))
+        (asserts! (is-eq tx-sender (var-get recipient)) (err ERR_NOT_ALLOWED))
+        (ok true))
 )
 
 ;; Returns the *total* vested amount at `burn-height`, i.e.

Original file line number	Diff line number	Diff line change
`@@ -71,7 +71,10 @@`
`71`	`71`	`)`
`72`	`72`
`73`	`73`	`(define-private (validate-caller)`
`74`		`- (ok (asserts! (is-eq contract-caller (var-get recipient)) (err ERR_NOT_ALLOWED)))`
	`74`	`+ (begin`
	`75`	`+ (asserts! (is-eq contract-caller (var-get recipient)) (err ERR_NOT_ALLOWED))`
	`76`	`+ (asserts! (is-eq tx-sender (var-get recipient)) (err ERR_NOT_ALLOWED))`
	`77`	`+ (ok true))`
`75`	`78`	`)`
`76`	`79`
`77`	`80`	;; Returns the total vested amount at `burn-height`, i.e.