Skip to content

Conversation

@moul
Copy link
Member

@moul moul commented Jan 19, 2026

memberstore.Tiers was a public variable (var Tiers TiersByName) that exposed the underlying *avl.Tree. External realms could call memberstore.Tiers.Set(...) to modify tier configurations,
escalating voting power or corrupting governance data.

h/t @jeronimoalbi for the report.

moul added 2 commits January 19, 2026 20:59
Signed-off-by: moul <94029+moul@users.noreply.github.com>
Signed-off-by: moul <94029+moul@users.noreply.github.com>
@Gno2D2
Copy link
Collaborator

Gno2D2 commented Jan 19, 2026

🛠 PR Checks Summary

All Automated Checks passed. ✅

Manual Checks (for Reviewers):
  • IGNORE the bot requirements for this PR (force green CI check)
Read More

🤖 This bot helps streamline PR reviews by verifying automated checks and providing guidance for contributors and reviewers.

✅ Automated Checks (for Contributors):

🟢 Maintainers must be able to edit this pull request (more info)

☑️ Contributor Actions:
  1. Fix any issues flagged by automated checks.
  2. Follow the Contributor Checklist to ensure your PR is ready for review.
    • Add new tests, or document why they are unnecessary.
    • Provide clear examples/screenshots, if necessary.
    • Update documentation, if required.
    • Ensure no breaking changes, or include BREAKING CHANGE notes.
    • Link related issues/PRs, where applicable.
☑️ Reviewer Actions:
  1. Complete manual checks for the PR, including the guidelines and additional checks if applicable.
📚 Resources:
Debug
Automated Checks
Maintainers must be able to edit this pull request (more info)

If

🟢 Condition met
└── 🟢 And
    ├── 🟢 The base branch matches this pattern: ^master$
    └── 🟢 The pull request was created from a fork (head branch repo: moul/gno)

Then

🟢 Requirement satisfied
└── 🟢 Maintainer can modify this pull request

Manual Checks
**IGNORE** the bot requirements for this PR (force green CI check)

If

🟢 Condition met
└── 🟢 On every pull request

Can be checked by

  • Any user with comment edit permission

@moul moul marked this pull request as ready for review January 19, 2026 21:05
Copy link
Member

@MikaelVallenet MikaelVallenet left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm, related to this i made a PR with linter that add rule that would trigger exporting global var -> #5068

Copy link
Contributor

@Davphla Davphla left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm, it would be a good idea to verify any similar issues in other realms

@moul
Copy link
Member Author

moul commented Jan 23, 2026

Exporting global vars make sense if they are safe objects.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

🧾 package/realm Tag used for new Realms or Packages.

Projects

Status: No status
Status: 📥 Inbox

Development

Successfully merging this pull request may close these issues.

6 participants