From 84c9adf5a6a243bd583f2144176f80708fa6a884 Mon Sep 17 00:00:00 2001
From: Christian Grothoff <christian@grothoff.org>
Date: Sat, 25 Dec 2021 14:58:04 +0100
Subject: v12: also do not sign over merchant_pub in REFUND signature,
 centralize logic

---
 src/auditor/taler-helper-auditor-coins.c | 57 +++++++++++++-------------------
 1 file changed, 23 insertions(+), 34 deletions(-)

(limited to 'src/auditor')

diff --git a/src/auditor/taler-helper-auditor-coins.c b/src/auditor/taler-helper-auditor-coins.c
index 0544edfbc..a295a035a 100644
--- a/src/auditor/taler-helper-auditor-coins.c
+++ b/src/auditor/taler-helper-auditor-coins.c
@@ -1794,41 +1794,30 @@ refund_cb (void *cls,
   }
 
   /* verify refund signature */
+  if (GNUNET_OK !=
+      TALER_merchant_refund_verify (coin_pub,
+                                    h_contract_terms,
+                                    rtransaction_id,
+                                    amount_with_fee,
+                                    merchant_pub,
+                                    merchant_sig))
   {
-    struct TALER_RefundRequestPS rr = {
-      .purpose.purpose = htonl (TALER_SIGNATURE_MERCHANT_REFUND),
-      .purpose.size = htonl (sizeof (rr)),
-      .h_contract_terms = *h_contract_terms,
-      .coin_pub = *coin_pub,
-      .merchant = *merchant_pub,
-      .rtransaction_id = GNUNET_htonll (rtransaction_id),
-    };
-
-    TALER_amount_hton (&rr.refund_amount,
-                       amount_with_fee);
-    if (GNUNET_OK !=
-        GNUNET_CRYPTO_eddsa_verify (TALER_SIGNATURE_MERCHANT_REFUND,
-                                    &rr,
-                                    &merchant_sig->eddsa_sig,
-                                    &merchant_pub->eddsa_pub))
-    {
-      TALER_ARL_report (report_bad_sig_losses,
-                        GNUNET_JSON_PACK (
-                          GNUNET_JSON_pack_string ("operation",
-                                                   "refund"),
-                          GNUNET_JSON_pack_uint64 ("row",
-                                                   rowid),
-                          TALER_JSON_pack_amount ("loss",
-                                                  amount_with_fee),
-                          GNUNET_JSON_pack_data_auto ("coin_pub",
-                                                      coin_pub)));
-      TALER_ARL_amount_add (&total_bad_sig_loss,
-                            &total_bad_sig_loss,
-                            amount_with_fee);
-      if (TALER_ARL_do_abort ())
-        return GNUNET_SYSERR;
-      return GNUNET_OK;
-    }
+    TALER_ARL_report (report_bad_sig_losses,
+                      GNUNET_JSON_PACK (
+                        GNUNET_JSON_pack_string ("operation",
+                                                 "refund"),
+                        GNUNET_JSON_pack_uint64 ("row",
+                                                 rowid),
+                        TALER_JSON_pack_amount ("loss",
+                                                amount_with_fee),
+                        GNUNET_JSON_pack_data_auto ("coin_pub",
+                                                    coin_pub)));
+    TALER_ARL_amount_add (&total_bad_sig_loss,
+                          &total_bad_sig_loss,
+                          amount_with_fee);
+    if (TALER_ARL_do_abort ())
+      return GNUNET_SYSERR;
+    return GNUNET_OK;
   }
 
   TALER_amount_ntoh (&refund_fee,
-- 
cgit v1.2.3