Missing validation
Code maturity is a critical aspect of high-assurance projects. By implementing checks, we can protect against potential mishaps, reduce the risk of lost funds or frozen protocols, and improve user experience. In addition, adding extra error messages can help clarify the internal mechanisms and reduce potential bugs that future developers might introduce while building on this project.
keeper_cross_chain_tx_vote_outbound_tx.go: VoteOnObservedOutboundTx
- There is no check that theobservationChain
is notnil
, which will cause a panic. During the normal operation, the chain should always exist, but since theIsAuthorized
check uses theobservationChain
, it is possible for anyone to trigger it by sending aMsgVoteOnObservedOutboundTx
message. The panic is handled by the default recovery middleware but would be better to explicitly check fornil
and return an error.
btc_signer.go: SignWithdrawTx
- The value of the out transaction is calculated withremainingSatoshis - fees
, but there is no guarantee thatremainingSatoshis
is greater than the fees, which would result in a negative value and the transaction failing. It would be better to explicitly check for this case and return an error indicating what has happened.