From 7c6359f7c6890ff363bb48e738dd0f216ba05c2f Mon Sep 17 00:00:00 2001
From: Hongrui Fang <chfanghr@gmail.com>
Date: Thu, 13 Oct 2022 19:18:23 +0800
Subject: [PATCH] prevent privilege escalation

---
 agora/Agora/Stake/Scripts.hs | 50 ++++++++++++++++++++----------------
 1 file changed, 28 insertions(+), 22 deletions(-)

diff --git a/agora/Agora/Stake/Scripts.hs b/agora/Agora/Stake/Scripts.hs
index cb5676b..6831db3 100644
--- a/agora/Agora/Stake/Scripts.hs
+++ b/agora/Agora/Stake/Scripts.hs
@@ -343,32 +343,38 @@ mkStakeValidator
 
       restOfStakeInputDatums <- pletC $ ptail # stakeInputDatums
 
-      pguardC "All input stakes have the same owner or delegate" $
-        let allHaveSameOwner =
-              pall
-                # plam
-                  ( (#== firstStakeInputDatumF.owner)
-                      . (pfield @"owner" #)
-                  )
-                # restOfStakeInputDatums
-            allHaveSameDelegate =
-              pall
-                # plam
-                  ( (#== firstStakeInputDatumF.delegatedTo)
-                      . (pfield @"delegatedTo" #)
-                  )
-                # restOfStakeInputDatums
-         in allHaveSameOwner #|| allHaveSameDelegate
-
       authorizedBy <- pletC $ pauthorizedBy # authorizationContext txInfoF
 
-      let ownerSignsTransaction = authorizedBy # firstStakeInputDatumF.owner
+      PPair allHaveSameOwner allHaveSameDelegatee <-
+        pmatchC $
+          pfoldr
+            # plam
+              ( \d p -> unTermCont $ do
+                  dF <- pletFieldsC @'["owner", "delegatedTo"] d
+
+                  pure $
+                    pmatch p $ \(PPair allHaveSameOwner allHaveSameDelegatee) ->
+                      let allHaveSameOwner' =
+                            allHaveSameOwner
+                              #&& dF.owner #== firstStakeInputDatumF.owner
+                          allHaveSameDelegatee' =
+                            allHaveSameDelegatee
+                              #&& dF.delegatedTo #== firstStakeInputDatumF.delegatedTo
+                       in pcon $ PPair allHaveSameOwner' allHaveSameDelegatee'
+              )
+            # pcon (PPair (pconstant True) (pconstant True))
+            # restOfStakeInputDatums
+
+      let ownerSignsTransaction =
+            allHaveSameOwner
+              #&& authorizedBy # firstStakeInputDatumF.owner
 
           delegateSignsTransaction =
-            pmaybeData
-              # pconstant False
-              # plam ((authorizedBy #) . pfromData)
-              # pfromData firstStakeInputDatumF.delegatedTo
+            allHaveSameDelegatee
+              #&& pmaybeData
+                # pconstant False
+                # plam ((authorizedBy #) . pfromData)
+                # pfromData firstStakeInputDatumF.delegatedTo
 
           signedBy =
             pif