More accurately, the only check is that the channel is not already finalized.
It's therefore trivial to finalize a channel with any outcome I like, and thereby steal other participants' money.
|
function conclude(ConclusionProof memory proof) public { |
|
_conclude(proof); |
|
} |
and
|
function _conclude(ConclusionProof memory proof) internal { |
|
address channelId = proof.penultimateCommitment.channelId(); |
|
require( |
|
(outcomes[channelId].finalizedAt > now || outcomes[channelId].finalizedAt == 0), |
|
"Conclude: channel must not be finalized" |
|
); |
|
|
|
outcomes[channelId] = Outcome( |
|
proof.penultimateCommitment.destination, |
|
now, |
|
proof.penultimateCommitment, |
|
proof.penultimateCommitment.allocation |
|
); |
|
emit Concluded(channelId); |
|
} |