WICG/trust-token-api

Unbalanced limits on redemption records and token issuance

Opened this issue · 1 comments

The specification draft limits the number of redemption records an issuer can create to 2 within a lifespan of 48 hours. However, the specification also allows an issuer to issue up to 500 tokens.

This seems to be an unbalanced ratio, as an issuer could potentially issue a large number of tokens that cannot be redeemed in a timely manner.

Shouldn't the issuance x redemption ratio be balanced ?

@isabelcurado
@thiagodiogo

Tokens are from (for/associated with) issuers. Redemption records (and
redemption operation in general) are for (associated with) top level origin and
issuer pairs.

Redemption is limited for the same top level origin and issuer pair. This is to prevent a
malicious origin to redeem all the tokens stored.