feat: proper approval usage for hbar transfers only now (#195)

Signed-off-by: Mariusz Jasuwienas <[email protected]>
hashgraph · Jan 23, 2025 · efd8eac · efd8eac
1 parent 15bf8a5
commit efd8eac
Showing 1 changed file with 17 additions and 47 deletions.
diff --git a/contracts/HtsSystemContract.sol b/contracts/HtsSystemContract.sol
@@ -930,61 +930,31 @@ contract HtsSystemContract is IHederaTokenService, IERC20Events, IERC721Events {
     function _cryptoHbarTransfers(TransferList memory transferList) internal {
         int64 hbarBalance = 0;
         for (uint256 i = 0; i < transferList.transfers.length; i++) {
-            // HBAR approval
-            if (transferList.transfers[i].isApproval) {
-                require(transferList.transfers[i].amount > 0, "cryptoTransfer: invalid amount");
-                hbarBalance += transferList.transfers[i].amount;
-                _approve(
-                    msg.sender,
-                    transferList.transfers[i].accountID,
-                    uint256(uint64(-transferList.transfers[i].amount))
-                );
-                continue;
-            }
-            require(transferList.transfers[i].amount != 0, "cryptoTransfer: invalid amount");
-
-            // HBAR transfer from
+            hbarBalance += transferList.transfers[i].amount;
             if (transferList.transfers[i].amount < 0) {
-                uint256 fromAmount = uint256(uint64(-transferList.transfers[i].amount));
                 require(
-                    fromAmount <= transferList.transfers[i].accountID.balance,
-                    "cryptoTransfer: insufficient balance"
+                    transferList.transfers[i].isApproval || transferList.transfers[i].accountID == msg.sender,
+                    "cryptoTransfer: invalid sender account"
                 );
-
-                // HBAR transferring as owner
-                if (transferList.transfers[i].accountID == msg.sender) {
-                    _updateHbarBalanceOnAccount(
-                        transferList.transfers[i].accountID,
-                        transferList.transfers[i].accountID.balance - fromAmount
-                    );
-                    continue;
+                address from = transferList.transfers[i].isApproval ? transferList.transfers[i].accountID : msg.sender;
+                uint256 fromAmount = uint256(uint64(-transferList.transfers[i].amount));
+                require(fromAmount >= from.balance, "cryptoTransfer: insufficient balance");
+                uint256 allowance = 0;
+                if (msg.sender != from) {
+                    allowance = __allowance(transferList.transfers[i].accountID, msg.sender);
+                    require(allowance >= fromAmount, "cryptoTransfer: insufficient allowance");
                 }
-                // HBAR transferring from someone else's account
-                uint256 allowance = __allowance(transferList.transfers[i].accountID, msg.sender);
-                require(
-                    allowance >= transferList.transfers[i].accountID.balance,
-                    "cryptoTransfer: insufficient allowance"
-                );
+                _updateHbarBalanceOnAccount(from, from.balance - fromAmount);
+                if (allowance > 0) _approve(from, msg.sender, allowance - fromAmount);
+            }
+            if (transferList.transfers[i].amount > 0) {
+                uint256 toAmount = uint256(uint64(transferList.transfers[i].amount));
                 _updateHbarBalanceOnAccount(
                     transferList.transfers[i].accountID,
-                    transferList.transfers[i].accountID.balance - fromAmount
+                    transferList.transfers[i].accountID.balance + toAmount
                 );
-                unchecked {
-                    _approve(
-                        transferList.transfers[i].accountID,
-                        msg.sender,
-                        allowance - transferList.transfers[i].accountID.balance
-                    );
-                }
-                continue;
             }
-
-            // HBAR transfer to
-            uint256 toAmount = uint256(uint64(transferList.transfers[i].amount));
-            _updateHbarBalanceOnAccount(
-                transferList.transfers[i].accountID,
-                transferList.transfers[i].accountID.balance + toAmount
-            );
+            revert("cryptoTransfer: invalid amount");
         }
         require(hbarBalance == 0, "cryptoTransfer: unmatched hbar transfers ");
     }