The current recoup API is broken. I guess this is another example where "trivial" API changes turn out to have (multiple!) unexpected consequences.

The current "/recoup" API does not have clear idempotency semantics, as we've discussed on the phone.  This is already bad by itself, as it makes it hard to write down what the API does other than "whatever the implementation does".

However, it actually breaks correctness in this (admittedly kinda contrived, but not impossible) case:

Say that we have a coin A obtained via withdrawal and a coin B obtained via refreshing coin A. Now the denominations of A gets revoked..

The wallet does a recoup of A for EUR:1.

Now the denomination of B also gets revoked.  The wallet recoups B (incidentally also for EUR:1) and now A can be recouped again for EUR:1.  But now the exchange is in a state where it will refuse a legitimate recoup request for A because the detection for an idempotent request kicks in.

This is IMHO bad API design, and the exchange should simply always recoup the maximum amount.

Furthermore, we usually follow the principle of "API calls that take up DB space are paid".  With the current recoup API, I can do many tiny recoup requests which the exchange then has to store, right?

I guess it would not be a big change to remove the "amount" value from the recoup/recoup-refresh request bodies, right?

- Florian

1 files changed, 0 insertions, 12 deletions

diff --git a/src/util/wallet_signatures.c b/src/util/wallet_signatures.c
index c46dd670b..bc4903e0e 100644
--- a/src/util/wallet_signatures.c
+++ b/src/util/wallet_signatures.c
@@ -157,7 +157,6 @@ enum GNUNET_GenericReturnValue
 TALER_wallet_recoup_verify (
   const struct TALER_DenominationHash *h_denom_pub,
   const union TALER_DenominationBlindingKeyP *coin_bks,
-  const struct TALER_Amount *requested_amount,
   const struct TALER_CoinSpendPublicKeyP *coin_pub,
   const struct TALER_CoinSpendSignatureP *coin_sig)
 {
@@ -168,8 +167,6 @@ TALER_wallet_recoup_verify (
     .coin_blind = *coin_bks
   };
 
-  TALER_amount_hton (&pr.recoup_amount,
-                     requested_amount);
   return GNUNET_CRYPTO_eddsa_verify (TALER_SIGNATURE_WALLET_COIN_RECOUP,
                                      &pr,
                                      &coin_sig->eddsa_signature,
@@ -181,7 +178,6 @@ void
 TALER_wallet_recoup_sign (
   const struct TALER_DenominationHash *h_denom_pub,
   const union TALER_DenominationBlindingKeyP *coin_bks,
-  const struct TALER_Amount *requested_amount,
   const struct TALER_CoinSpendPrivateKeyP *coin_priv,
   struct TALER_CoinSpendSignatureP *coin_sig)
 {
@@ -192,8 +188,6 @@ TALER_wallet_recoup_sign (
     .coin_blind = *coin_bks
   };
 
-  TALER_amount_hton (&pr.recoup_amount,
-                     requested_amount);
   GNUNET_CRYPTO_eddsa_sign (&coin_priv->eddsa_priv,
                             &pr,
                             &coin_sig->eddsa_signature);
@@ -204,7 +198,6 @@ enum GNUNET_GenericReturnValue
 TALER_wallet_recoup_refresh_verify (
   const struct TALER_DenominationHash *h_denom_pub,
   const union TALER_DenominationBlindingKeyP *coin_bks,
-  const struct TALER_Amount *requested_amount,
   const struct TALER_CoinSpendPublicKeyP *coin_pub,
   const struct TALER_CoinSpendSignatureP *coin_sig)
 {
@@ -215,8 +208,6 @@ TALER_wallet_recoup_refresh_verify (
     .coin_blind = *coin_bks
   };
 
-  TALER_amount_hton (&pr.recoup_amount,
-                     requested_amount);
   return GNUNET_CRYPTO_eddsa_verify (TALER_SIGNATURE_WALLET_COIN_RECOUP_REFRESH,
                                      &pr,
                                      &coin_sig->eddsa_signature,
@@ -228,7 +219,6 @@ void
 TALER_wallet_recoup_refresh_sign (
   const struct TALER_DenominationHash *h_denom_pub,
   const union TALER_DenominationBlindingKeyP *coin_bks,
-  const struct TALER_Amount *requested_amount,
   const struct TALER_CoinSpendPrivateKeyP *coin_priv,
   struct TALER_CoinSpendSignatureP *coin_sig)
 {
@@ -239,8 +229,6 @@ TALER_wallet_recoup_refresh_sign (
     .coin_blind = *coin_bks
   };
 
-  TALER_amount_hton (&pr.recoup_amount,
-                     requested_amount);
   GNUNET_CRYPTO_eddsa_sign (&coin_priv->eddsa_priv,
                             &pr,
                             &coin_sig->eddsa_signature);