Fix MayUseToken vulnerability in AccountUpdates

CHANGELOG.md

@@ -17,6 +17,12 @@ This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.htm
 
 ## [Unreleased](https://github.com/o1-labs/o1js/compare/ed198f305...HEAD)
 
+### Fixed
+
+- Address potential incorrect token inheritance handling with `MayUseToken` in AccountUpdates https://github.com/o1-labs/o1js/pull/1716
+  - Modified isParentsOwnToken() to return false when inheritFromParent is true, preventing potential misuse of token inheritance.
+  - Added check() method to ensure parentsOwnToken and inheritFromParent flags are not both set to true simultaneously.
+
 ## [1.4.0](https://github.com/o1-labs/o1js/compare/40c597775...ed198f305) - 2024-06-25
 
 ### Added

src/lib/mina/account-update.ts

@@ -1193,11 +1193,22 @@ class AccountUpdate implements Types.AccountUpdate {
         return parentsOwnToken.or(inheritFromParent).not();
       },
       isParentsOwnToken(a: AccountUpdate) {
-        return a.body.mayUseToken.parentsOwnToken;
+        // Check that inheritFromParent is not true when validating if an account update is for a parent's own token
+        return a.body.mayUseToken.parentsOwnToken.and(
+          a.body.mayUseToken.inheritFromParent.not()
+        );
       },
       isInheritFromParent(a: AccountUpdate) {
         return a.body.mayUseToken.inheritFromParent;
       },
+      check(mayUseToken: { parentsOwnToken: Bool; inheritFromParent: Bool }) {
+        // Ensure the flags are not both set to true
+        mayUseToken.parentsOwnToken
+          .and(mayUseToken.inheritFromParent)
+          .assertFalse(
+            'MayUseToken: parentsOwnToken and inheritFromParent cannot both be true'
+          );
+      },
     };
   }
 

src/lib/mina/account-update.unit-test.ts

@@ -6,6 +6,7 @@ import {
   Mina,
   Int64,
   Types,
+  Bool,
 } from '../../index.js';
 import { Test } from '../../snarky.js';
 import { expect } from 'expect';
@@ -20,6 +21,14 @@ function createAccountUpdate() {
   return accountUpdate;
 }
 
+function createAccountUpdateWithMayUseToken(
+  mayUseToken: AccountUpdate['body']['mayUseToken']
+) {
+  let accountUpdate = AccountUpdate.defaultAccountUpdate(address);
+  accountUpdate.body.mayUseToken = mayUseToken;
+  return accountUpdate;
+}
+
 // can convert account update to fields consistently
 {
   let accountUpdate = createAccountUpdate();
@@ -122,3 +131,54 @@ function createAccountUpdate() {
     'Check signature: Invalid signature on fee payer for key'
   );
 }
+
+// correctly identifies parentsOwnToken and not inheritFromParent
+{
+  let accountUpdate = createAccountUpdateWithMayUseToken({
+    parentsOwnToken: Bool(true),
+    inheritFromParent: Bool(false),
+  });
+  expect(
+    AccountUpdate.MayUseToken.isParentsOwnToken(accountUpdate).toBoolean()
+  ).toEqual(true);
+  expect(
+    AccountUpdate.MayUseToken.isInheritFromParent(accountUpdate).toBoolean()
+  ).toEqual(false);
+}
+
+// correctly identifies inheritFromParent and not parentsOwnToken
+{
+  let accountUpdate = createAccountUpdateWithMayUseToken({
+    parentsOwnToken: Bool(false),
+    inheritFromParent: Bool(true),
+  });
+  expect(
+    AccountUpdate.MayUseToken.isParentsOwnToken(accountUpdate).toBoolean()
+  ).toEqual(false);
+  expect(
+    AccountUpdate.MayUseToken.isInheritFromParent(accountUpdate).toBoolean()
+  ).toEqual(true);
+}
+
+// throws an error when both flags are true in check method
+{
+  expect(() => {
+    AccountUpdate.MayUseToken.check({
+      parentsOwnToken: Bool(true),
+      inheritFromParent: Bool(true),
+    });
+  }).toThrowError(
+    'MayUseToken: parentsOwnToken and inheritFromParent cannot both be true'
+  );
+}
+
+// correctly identifies when neither flag is set
+{
+  let accountUpdate = createAccountUpdateWithMayUseToken({
+    parentsOwnToken: Bool(false),
+    inheritFromParent: Bool(false),
+  });
+  expect(AccountUpdate.MayUseToken.isNo(accountUpdate).toBoolean()).toEqual(
+    true
+  );
+}