Restricted wallet
Security warning
Restricted Wallet is unmaintained and has unresolved security issues.
Restricted Wallet is a validator-staking wallet with destination checks for the owner and permitted system-contract operations. The Single Nominator project describes it as an alternative to its nominator-pool contract and documents unresolved attack vectors. The checks apply only while the configured restriction is active; they do not guarantee that funds cannot be lost.
What makes it different
Restricted Wallet checks the destinations of outgoing messages against its configured owner address and permitted system-contract operations. The check does not validate message bodies or make permitted operations harmless.
Standard wallet behavior:
You can send funds to any valid address.
Restricted Wallet behavior:
You can only send funds to the predefined owner address or do operations with Elector (new stake, recover stake request, new complaint, and vote for a complaint) and Config (vote for specific proposal to change config) contracts.
How it works
Legacy Restricted Wallet code uses config_param(-13) as an activation timestamp. If the parameter is absent, the restriction remains active; if set, destination checks stop when its timestamp is no longer in the future, according to the configuration parameter rules.
The wallet holds stake principal and fee funds in one balance. The upstream project documents gas-drain attacks that can consume principal and a withdrawal race between an attacker and owner submitting requests with the same seqno (security notes). A valid request can still spend Gram on fees, and mode 128 sends the remaining balance to an allowed destination. Check the active restriction and serialize submissions.
Allowed actions
- Send a message to the owner of this wallet.
- Send "vote for a configuration proposal" message to the Config contract.
- Send "new stake", "recover stake request", "new complaint", or "vote for a complaint" messages to the Elector contract.
It is allowed to use message modes 128, 64, 2, and 1. Mode 2 (ignore errors) is always enabled when sending messages from this wallet.