Skip to content

Requested changes from PR 29#44

Merged
rob1997 merged 14 commits into
mainfrom
rob1997/requested-changes-from-pr-29
Mar 4, 2026
Merged

Requested changes from PR 29#44
rob1997 merged 14 commits into
mainfrom
rob1997/requested-changes-from-pr-29

Conversation

@rob1997
Copy link
Copy Markdown
Contributor

@rob1997 rob1997 commented Mar 3, 2026

Summary

Addresses requested changes from PR #29 audit review. Implements pull-payment model for fees (claim vs. immediate transfer), subscription cancellation with prorated refunds, typo fix, zero-address validation, and additional tests. README and RPC API refs updated.

Changes

Asset

  • Pull-payment model: Subscription payments held in the Asset contract; creator and registry claim fees via claimCreatorFee and claimRegistryFee instead of immediate transfer.
  • Subscription struct: subscriptions now maps bytes32(id) to Subscription { startTime, endTime, subscriptionPrice }; uses nonces and EnumerableSet for subscribers.
  • claimCreatorFee / claimRegistryFee: Creator claims via claimCreatorFee(subscriber); registry claims via claimRegistryFee(subscriber) on the Asset (registry calls it via claimRegistryFee(assetId, subscriber)).
  • Subscription cancellation: cancelSubscription() allows users to cancel and receive prorated refund. revokeSubscription (owner) also triggers prorated refund.
  • Typo fix: onlyRegsitryOrOwneronlyRegistryOrOwner.
  • Zero-address validation: Constructor reverts on _owner == address(0) or _tokenAddress == address(0).

AssetRegistry

  • getFees: Added getFees(uint256 _value) returning (creatorFee, registryFee).
  • claimRegistryFee: Registry owner can call claimRegistryFee(assetId, subscriber) to pull registry share.
  • Renames: viewSubscription(bytes32)viewMySubscription(bytes32), getSubscription(bytes32)getMySubscription(bytes32).

Interfaces

  • IAsset, IAssetRegistry updated for new functions and renames.

Tests

  • Revoke, cancel, claim flows; negative tests; hardcoded assertions where appropriate; claimRegistryFee tests.

Documentation

  • README updated with new flows, RPC API reference.
  • registries_*.json updates.

@rob1997 rob1997 self-assigned this Mar 3, 2026
@rob1997 rob1997 requested review from boorich, irubido and sqhell March 3, 2026 14:39
@rob1997 rob1997 marked this pull request as ready for review March 4, 2026 09:15
@rob1997 rob1997 merged commit 2cb79c8 into main Mar 4, 2026
1 check passed
Comment thread src/AssetRegistry.sol

function updateRegistryFeeShare(uint256 _registryFeeShare) external onlyOwner {
registryFeeShare = _registryFeeShare;
totalFeeShare = creatorFeeShare + registryFeeShare;
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

totalFeeShare can become zero if divided by zero
Add require(totalFeeShare > 0) after updating fee shares, or validate individual shares.

Comment thread test/AssetRegistry.t.sol
vm.stopPrank();
}

function test_claimRegistryFee() public {
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

claimCreatorFee and claimRegistryFee track separate claimedAt timestamps and compute fees using current fee shares (not the shares at subscription time)

users could set high register fee and drain balance.

the old design didn't have this issue as it computed and transferred fee splits at subscription time.

to fix: Store fee shares in the Subscription struct at subscribe time and use those for claims, and use single claimedAt. Make sure fee share changes only affect future subscriptions, so users aren't setting fees very high then returning normal to be able to drain the contract

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yep, nice catch!

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

already merged (deadlines...) but will fix

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants