🐛 Treasury Proposal Creation Allowed Without Receiving Stake Address and Amount

[kneerose]

Area

Proposal Pillar

Domain

dev-sanchogov.tools

Which wallet were you using?

No response

Context

While creating a treasury proposal, the "Receiving Stake Address" and "Amount" fields are marked as required. However, it is possible to proceed to the next step even if these fields are left empty. As a result, I can create a treasury proposal without providing a receiving stake address or amount. When attempting to submit this proposal to the governance action, an error occurs.

To prevent this issue, the Continue button should be disabled and proposal creation should be rejected if the "Receiving Stake Address" or "Amount" field is empty or invalid.

Steps to reproduce

1. Connect your wallet.
2. Navigate to the Create Proposal form.
3. Select the governance action type Treasury.
4. Fill in all required fields except "Receiving Stake Address" and "Amount."
5. Observe that the Continue button is enabled, allowing submission of a treasury proposal without these fields.
6. Submit the incomplete proposal to governance action.
7. Observe the error message displayed.

Actual behavior

• The Continue button is enabled even when "Receiving Stake Address" and "Amount" fields are empty or invalid.

• for wrong "Receiving Stake Address" address and "Amount"

• A treasury proposal can be created without these required fields.

• An error occurs upon submitting the incomplete proposal to governance action.

Expected behavior

• Treasury proposal creation should be rejected if the "Receiving Stake Address" or "Amount" field is empty or invalid.
• The Continue button should be disabled until both fields are correctly filled.

[sentry-io]

Sentry Issue: GOVTOOL-FRONTEND-A9

[kneerose]

@nebojsact , The frontend correctly prevents proceeding to the next step in treasury proposal creation if the "Receiving Stake Address" or "Amount" fields are empty or invalid. This functionality ensures user input validation on the client side.

However, the backend currently allows the creation of treasury proposals without validating these fields, resulting in inconsistent behavior.

Example: Creating a Treasury Proposal Without "Receiving Stake Address" or "Amount"

The following curl command demonstrates how a treasury proposal can be created via the backend API without providing the "Receiving Stake Address" or "Amount":

curl 'https://z74f91f2d-zb0719f09-gtw.z937eb260.rustrocks.fr/api/proposals' \
  -H 'accept: application/json, text/plain, */*' \
  -H 'accept-language: en,en-GB;q=0.9,en-US;q=0.8' \
  -H 'authorization: Bearer xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx' \
  -H 'content-type: application/json' \
  -H 'origin: https://dev-sanchonet.govtool.byron.network' \
  -H 'priority: u=1, i' \
  -H 'referer: https://dev-sanchonet.govtool.byron.network/' \
  -H 'sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"' \
  -H 'sec-ch-ua-mobile: ?0' \
  -H 'sec-ch-ua-platform: "Linux"' \
  -H 'sec-fetch-dest: empty' \
  -H 'sec-fetch-mode: cors' \
  -H 'sec-fetch-site: cross-site' \
  -H 'user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36' \
  --data-raw '{"data":{"proposal_links":[],"proposal_withdrawals":[],"gov_action_type_id":2,"prop_name":"testWithCurl","prop_abstract":"asd","prop_motivation":"asd","prop_rationale":"aasd","is_draft":false}}'

Example: Creating a Proposal With an Invalid Stake Address

The backend also allows proposals to be created with an incorrect stake address. The following example uses an invalid "Receiving Stake Address" (stake1):

curl 'https://z74f91f2d-zb0719f09-gtw.z937eb260.rustrocks.fr/api/proposals' \
  -H 'accept: application/json, text/plain, */*' \
  -H 'accept-language: en,en-GB;q=0.9,en-US;q=0.8' \
  -H 'authorization: Bearer XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX' \
  -H 'content-type: application/json' \
  -H 'origin: https://dev-sanchonet.govtool.byron.network' \
  -H 'priority: u=1, i' \
  -H 'referer: https://dev-sanchonet.govtool.byron.network/' \
  -H 'sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"' \
  -H 'sec-ch-ua-mobile: ?0' \
  -H 'sec-ch-ua-platform: "Linux"' \
  -H 'sec-fetch-dest: empty' \
  -H 'sec-fetch-mode: cors' \
  -H 'sec-fetch-site: cross-site' \
  -H 'user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36' \
  --data-raw '{"data":{"proposal_links":[],"proposal_withdrawals":[{"prop_receiving_address":"stake1","prop_amount":"1232"}],"gov_action_type_id":2,"prop_name":"asd","prop_abstract":"afdsfdsfg","prop_motivation":"fdgdfg","prop_rationale":"dfg","is_draft":false}}'

Note

• Ensure the backend validates both the "Receiving Stake Address" and "Amount" fields.
• Reject any requests with:
  - Empty "Receiving Stake Address".
  - Invalid or malformed "Receiving Stake Address".
  - Missing or non-numeric "Amount".

CC: @bosko-m

[kneerose]

@nebojsact I am still able to reproduce this issue. Could you confirm in which version of the PDFUI this issue is fixed? I believe the current PDFUI version is v0.5.4 on dev.

CC: @bosko-m

[nebojsact]

Hi @kneerose, this one is fixed in latest version of pdf backend [image: image.png]

…

On Mon, Dec 9, 2024 at 5:19 AM Niraj Duwal ***@***.***> wrote: @nebojsact <https://github.com/nebojsact> I am still able to reproduce this issue. Could you confirm in which version of the PDFUI this issue is fixed? I believe the current PDFUI version is v0.5.4 on dev. image.png (view on web) <https://github.com/user-attachments/assets/7a057c00-633e-4ea6-b1b7-77830bd9d00b> CC: @bosko-m <https://github.com/bosko-m> — Reply to this email directly, view it on GitHub <#2435 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AKSYINEZVFT6CYR7AIXGLD32EUK4RAVCNFSM6AAAAABSUMGIFWVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDKMRWHA2TGNZQGY> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[kneerose]

@MSzalowski , I am unable to test this as the new PDF version has not been updated in the dev environment. Could you please update it to the latest version?
CC: @bosko-m

[kneerose]

@nebojsact , has the latest version of the backend been updated? I am still able to reproduce this issue.

[bosko-m]

As soon as we have a deployment to preview, you will be able to test it @kneerose