diff --git a/aptos-move/framework/aptos-framework/doc/account.md b/aptos-move/framework/aptos-framework/doc/account.md index 276d6bd47b6244..6b40dbd5d2eec6 100644 --- a/aptos-move/framework/aptos-framework/doc/account.md +++ b/aptos-move/framework/aptos-framework/doc/account.md @@ -105,6 +105,7 @@ use 0x1::hash; use 0x1::multi_ed25519; use 0x1::option; +use 0x1::permissioned_signer; use 0x1::signer; use 0x1::system_addresses; use 0x1::table; @@ -818,6 +819,15 @@ An attempt to create a resource account on a claimed account + + + + +
const EROTATION_WITH_PERMISSIONED_SIGNER: u64 = 20;
+
+ + + Sequence number exceeds the maximum value for a u64 @@ -1167,6 +1177,10 @@ many contexts: vector::length(&new_auth_key) == 32, error::invalid_argument(EMALFORMED_AUTHENTICATION_KEY) ); + assert!( + !permissioned_signer::is_permissioned_signer(account), + error::permission_denied(EROTATION_WITH_PERMISSIONED_SIGNER) + ); let account_resource = borrow_global_mut<Account>(addr); account_resource.authentication_key = new_auth_key; } @@ -1259,6 +1273,10 @@ to rotate his address to Alice's address in the first place. ) acquires Account, OriginatingAddress { let addr = signer::address_of(account); assert!(exists_at(addr), error::not_found(EACCOUNT_DOES_NOT_EXIST)); + assert!( + !permissioned_signer::is_permissioned_signer(account), + error::permission_denied(EROTATION_WITH_PERMISSIONED_SIGNER) + ); let account_resource = borrow_global_mut<Account>(addr); // Verify the given `from_public_key_bytes` matches this account's current authentication key. @@ -1334,6 +1352,10 @@ to rotate his address to Alice's address in the first place. new_public_key_bytes: vector<u8>, cap_update_table: vector<u8> ) acquires Account, OriginatingAddress { + assert!( + !permissioned_signer::is_permissioned_signer(delegate_signer), + error::permission_denied(EROTATION_WITH_PERMISSIONED_SIGNER) + ); assert!(exists_at(rotation_cap_offerer_address), error::not_found(EOFFERER_ADDRESS_DOES_NOT_EXIST)); // Check that there exists a rotation capability offer at the offerer's account resource for the delegate. @@ -1413,6 +1435,10 @@ offer, calling this function will replace the previous recipient_addressvector<u8>, recipient_address: address, ) acquires Account { + assert!( + !permissioned_signer::is_permissioned_signer(account), + error::permission_denied(EROTATION_WITH_PERMISSIONED_SIGNER) + ); let addr = signer::address_of(account); assert!(exists_at(recipient_address), error::not_found(EACCOUNT_DOES_NOT_EXIST)); @@ -1612,6 +1638,10 @@ to the account owner's signer capability). account_public_key_bytes: vector<u8>, recipient_address: address ) acquires Account { + assert!( + !permissioned_signer::is_permissioned_signer(account), + error::permission_denied(EROTATION_WITH_PERMISSIONED_SIGNER) + ); let source_address = signer::address_of(account); assert!(exists_at(recipient_address), error::not_found(EACCOUNT_DOES_NOT_EXIST)); @@ -1769,6 +1799,10 @@ at the offerer's address. 
public fun create_authorized_signer(account: &signer, offerer_address: address): signer acquires Account {
+    assert!(
+        !permissioned_signer::is_permissioned_signer(account),
+        error::permission_denied(EROTATION_WITH_PERMISSIONED_SIGNER)
+    );
     assert!(exists_at(offerer_address), error::not_found(EOFFERER_ADDRESS_DOES_NOT_EXIST));
 
     // Check if there's an existing signer capability offer from the offerer.
diff --git a/aptos-move/framework/aptos-framework/sources/account.move b/aptos-move/framework/aptos-framework/sources/account.move
index a249fbb2d3d09a..f9050583f718a9 100644
--- a/aptos-move/framework/aptos-framework/sources/account.move
+++ b/aptos-move/framework/aptos-framework/sources/account.move
@@ -9,6 +9,7 @@ module aptos_framework::account {
     use aptos_framework::create_signer::create_signer;
     use aptos_framework::event::{Self, EventHandle};
     use aptos_framework::guid;
+    use aptos_framework::permissioned_signer;
     use aptos_framework::system_addresses;
     use aptos_std::ed25519;
     use aptos_std::from_bcs;
@@ -169,6 +170,8 @@ module aptos_framework::account {
     const ENO_SIGNER_CAPABILITY_OFFERED: u64 = 19;
     // This account has exceeded the allocated GUIDs it can create. It should be impossible to reach this number for real applications.
     const EEXCEEDED_MAX_GUID_CREATION_NUM: u64 = 20;
+    // Try to rotate auth key via a permissioned signer.
+    const EROTATION_WITH_PERMISSIONED_SIGNER: u64 = 20;
 
     /// Explicitly separate the GUID space between Object and Account to prevent accidental overlap.
     const MAX_GUID_CREATION_NUM: u64 = 0x4000000000000;
@@ -282,6 +285,10 @@ module aptos_framework::account {
             vector::length(&new_auth_key) == 32,
             error::invalid_argument(EMALFORMED_AUTHENTICATION_KEY)
         );
+        assert!(
+            !permissioned_signer::is_permissioned_signer(account),
+            error::permission_denied(EROTATION_WITH_PERMISSIONED_SIGNER)
+        );
         let account_resource = borrow_global_mut(addr);
         account_resource.authentication_key = new_auth_key;
     }
@@ -334,6 +341,10 @@ module aptos_framework::account {
     ) acquires Account, OriginatingAddress {
         let addr = signer::address_of(account);
         assert!(exists_at(addr), error::not_found(EACCOUNT_DOES_NOT_EXIST));
+        assert!(
+            !permissioned_signer::is_permissioned_signer(account),
+            error::permission_denied(EROTATION_WITH_PERMISSIONED_SIGNER)
+        );
         let account_resource = borrow_global_mut(addr);
 
         // Verify the given `from_public_key_bytes` matches this account's current authentication key.
@@ -389,6 +400,10 @@ module aptos_framework::account {
         new_public_key_bytes: vector,
         cap_update_table: vector
     ) acquires Account, OriginatingAddress {
+        assert!(
+            !permissioned_signer::is_permissioned_signer(delegate_signer),
+            error::permission_denied(EROTATION_WITH_PERMISSIONED_SIGNER)
+        );
         assert!(exists_at(rotation_cap_offerer_address), error::not_found(EOFFERER_ADDRESS_DOES_NOT_EXIST));
 
         // Check that there exists a rotation capability offer at the offerer's account resource for the delegate.
@@ -448,6 +463,10 @@ module aptos_framework::account {
         account_public_key_bytes: vector,
         recipient_address: address,
     ) acquires Account {
+        assert!(
+            !permissioned_signer::is_permissioned_signer(account),
+            error::permission_denied(EROTATION_WITH_PERMISSIONED_SIGNER)
+        );
         let addr = signer::address_of(account);
         assert!(exists_at(recipient_address), error::not_found(EACCOUNT_DOES_NOT_EXIST));
 
@@ -547,6 +566,10 @@ module aptos_framework::account {
         account_public_key_bytes: vector,
         recipient_address: address
     ) acquires Account {
+        assert!(
+            !permissioned_signer::is_permissioned_signer(account),
+            error::permission_denied(EROTATION_WITH_PERMISSIONED_SIGNER)
+        );
         let source_address = signer::address_of(account);
         assert!(exists_at(recipient_address), error::not_found(EACCOUNT_DOES_NOT_EXIST));
 
@@ -604,6 +627,10 @@ module aptos_framework::account {
     /// Return an authorized signer of the offerer, if there's an existing signer capability offer for `account`
     /// at the offerer's address.
     public fun create_authorized_signer(account: &signer, offerer_address: address): signer acquires Account {
+        assert!(
+            !permissioned_signer::is_permissioned_signer(account),
+            error::permission_denied(EROTATION_WITH_PERMISSIONED_SIGNER)
+        );
         assert!(exists_at(offerer_address), error::not_found(EOFFERER_ADDRESS_DOES_NOT_EXIST));
 
         // Check if there's an existing signer capability offer from the offerer.