src/securityPolicy.c
security_policy_t policyForSignTxOutputAddressBytes(
        sign_tx_signingmode_t txSigningMode,
        const uint8_t* rawAddressBuffer, size_t rawAddressSize,
        const uint8_t networkId, const uint32_t protocolMagic,
        bool includeDatumHash
)
{
	ASSERT(rawAddressSize < BUFFER_SIZE_PARANOIA);

	// address type and network identification
	ASSERT(rawAddressSize >= 1);
	const address_type_t addressType = getAddressType(rawAddressBuffer[0]);
	const uint8_t addressNetworkId = getNetworkId(rawAddressBuffer[0]);

	switch (addressType) {

	case BYRON:
		DENY_IF(extractProtocolMagic(rawAddressBuffer, rawAddressSize) != protocolMagic);
		break;

	case REWARD_KEY:
	case REWARD_SCRIPT:
		// outputs may not contain reward addresses
		DENY();
		break;

	default: // shelley types allowed in output
		DENY_IF(addressNetworkId != networkId);
		break;
	}

	if (includeDatumHash) {
		// together with the above requirement on SPENDING_PATH,
		// this forbids datum in change outputs entirely
		DENY_UNLESS(allows_datum_hash(addressType));

		// no Plutus elements for pool registration, only allow in other modes
		DENY_UNLESS(
		        txSigningMode == SIGN_TX_SIGNINGMODE_ORDINARY_TX ||
		        txSigningMode == SIGN_TX_SIGNINGMODE_MULTISIG_TX ||
		        txSigningMode == SIGN_TX_SIGNINGMODE_PLUTUS_TX
		);
	}

	switch (txSigningMode) {

	case SIGN_TX_SIGNINGMODE_POOL_REGISTRATION_OWNER:
		// all the funds are provided by the operator
		// and thus outputs are irrelevant to the owner (even those having tokens or datum hash)
		ALLOW();
		break;

	case SIGN_TX_SIGNINGMODE_ORDINARY_TX:
	case SIGN_TX_SIGNINGMODE_MULTISIG_TX:
	case SIGN_TX_SIGNINGMODE_POOL_REGISTRATION_OPERATOR:
	case SIGN_TX_SIGNINGMODE_PLUTUS_TX:
		// utxo on a Plutus script address without datum hash is unspendable
		// but we can't DENY because it is valid for native scripts
		WARN_IF(allows_datum_hash(addressType) && !includeDatumHash);
		// we always show third-party output addresses
		SHOW();
		break;

	default:
		ASSERT(false);
	}

	DENY(); // should not be reached
}
// For each transaction (third-party) address output
For each transaction (third-party) address output
For each transaction ( third - party ) address output
security_policy_t policyForSignTxOutputAddressBytes(
        sign_tx_signingmode_t txSigningMode,
        const uint8_t* rawAddressBuffer, size_t rawAddressSize,
        const uint8_t networkId, const uint32_t protocolMagic,
        bool includeDatumHash
)
{
	ASSERT(rawAddressSize < BUFFER_SIZE_PARANOIA);
	ASSERT(rawAddressSize >= 1);
	const address_type_t addressType = getAddressType(rawAddressBuffer[0]);
	const uint8_t addressNetworkId = getNetworkId(rawAddressBuffer[0]);
	switch (addressType) {
	case BYRON:
		DENY_IF(extractProtocolMagic(rawAddressBuffer, rawAddressSize) != protocolMagic);
		break;
	case REWARD_KEY:
	case REWARD_SCRIPT:
		DENY();
		break;
	default: 
		DENY_IF(addressNetworkId != networkId);
		break;
	}
	if (includeDatumHash) {
		DENY_UNLESS(allows_datum_hash(addressType));
		DENY_UNLESS(
		        txSigningMode == SIGN_TX_SIGNINGMODE_ORDINARY_TX ||
		        txSigningMode == SIGN_TX_SIGNINGMODE_MULTISIG_TX ||
		        txSigningMode == SIGN_TX_SIGNINGMODE_PLUTUS_TX
		);
	}
	switch (txSigningMode) {
	case SIGN_TX_SIGNINGMODE_POOL_REGISTRATION_OWNER:
		ALLOW();
		break;
	case SIGN_TX_SIGNINGMODE_ORDINARY_TX:
	case SIGN_TX_SIGNINGMODE_MULTISIG_TX:
	case SIGN_TX_SIGNINGMODE_POOL_REGISTRATION_OPERATOR:
	case SIGN_TX_SIGNINGMODE_PLUTUS_TX:
		WARN_IF(allows_datum_hash(addressType) && !includeDatumHash);
		SHOW();
		break;
	default:
		ASSERT(false);
	}
	DENY(); 
}
security_policy_t policyForSignTxOutputAddressBytes ( sign_tx_signingmode_t txSigningMode , const uint8_t * rawAddressBuffer , size_t rawAddressSize , const uint8_t networkId , const uint32_t protocolMagic , bool includeDatumHash ) { ASSERT ( rawAddressSize < BUFFER_SIZE_PARANOIA ) ; ASSERT ( rawAddressSize >= 1 ) ; const address_type_t addressType = getAddressType ( rawAddressBuffer [ 0 ] ) ; const uint8_t addressNetworkId = getNetworkId ( rawAddressBuffer [ 0 ] ) ; switch ( addressType ) { case BYRON : DENY_IF ( extractProtocolMagic ( rawAddressBuffer , rawAddressSize ) != protocolMagic ) ; break ; case REWARD_KEY : case REWARD_SCRIPT : DENY ( ) ; break ; default : DENY_IF ( addressNetworkId != networkId ) ; break ; } if ( includeDatumHash ) { DENY_UNLESS ( allows_datum_hash ( addressType ) ) ; DENY_UNLESS ( txSigningMode == SIGN_TX_SIGNINGMODE_ORDINARY_TX || txSigningMode == SIGN_TX_SIGNINGMODE_MULTISIG_TX || txSigningMode == SIGN_TX_SIGNINGMODE_PLUTUS_TX ) ; } switch ( txSigningMode ) { case SIGN_TX_SIGNINGMODE_POOL_REGISTRATION_OWNER : ALLOW ( ) ; break ; case SIGN_TX_SIGNINGMODE_ORDINARY_TX : case SIGN_TX_SIGNINGMODE_MULTISIG_TX : case SIGN_TX_SIGNINGMODE_POOL_REGISTRATION_OPERATOR : case SIGN_TX_SIGNINGMODE_PLUTUS_TX : WARN_IF ( allows_datum_hash ( addressType ) && ! includeDatumHash ) ; SHOW ( ) ; break ; default : ASSERT ( false ) ; } DENY ( ) ; }
For each transaction (third-party) address output
For each transaction ( third - party ) address output
// address type and network identification // outputs may not contain reward addresses // shelley types allowed in output // together with the above requirement on SPENDING_PATH, // this forbids datum in change outputs entirely // no Plutus elements for pool registration, only allow in other modes // all the funds are provided by the operator // and thus outputs are irrelevant to the owner (even those having tokens or datum hash) // utxo on a Plutus script address without datum hash is unspendable // but we can't DENY because it is valid for native scripts // we always show third-party output addresses // should not be reached