Contract Utxo Validation

[while0x1]

When designing a validator I wanted to check how the contract operates - if I have a constraint which makes sure that X ADA is being sent to Y address then the contract will be valid and it will allow you to do something like withdraw a utxo containing a token at the contract address - Do I also need to implement contract logic which ensures only 1 token UTXO is being withdraw from the contract address? Or will the validator logic apply to EACH utxo spent - ie) for every utxo withdrawn it will need to a have X ADA sent to Y address ?

[nielstron]

What you are describing is essentially "double satisfaction", a common weakness in contracts on cardano:

https://plutus.readthedocs.io/en/latest/reference/writing-scripts/common-weaknesses/double-satisfaction.html

In short: The contract is run for each input BUT you need to add logic to ensure that there is not one output that satisfies multiple inputs. This can be done in two canonical ways

1. make sure that there is no other input spent from the contract or
2. lock utxo with a unique datum and ensure that datum is somehow uniquely represented in the output

[while0x1]

Can we satisfy 1. by modifying the own_spent_utxo example?

proof of concept:

original own_spent f(x):

def own_spent_utxo(txins: List[TxInInfo], p: Spending) -> TxOut:
    # obtain the resolved txout that is going to be spent from this contract address
    for txi in txins:
        if txi.out_ref == p.tx_out_ref:
            own_txout = txi.resolved
    # This throws a name error if the txout was not found
    return own_txout 

count of contract utxos spent f(fx)

def own_spent_utxos(txins: List[TxInInfo], p: Spending) -> int:
    # obtain the resolved txout that is going to be spent from this contract address
    count=0
    for txi in txins:
        if txi.out_ref == p.tx_out_ref:
            count+=1
    # This throws a name error if the txout was not found
    return count

[nielstron]

Yes you can use the loop.

However the ref is always unique. It is essentially what output you are spending with this specific invocation of the contract. You need to extract the address of the validator and loop through all inputs to find anything spent from the validator address

[while0x1]

Hopefully this covers it:)

def own_spent_utxo(txins: List[TxInInfo], p: Spending) -> TxOut:
    for txi in txins:
        if txi.out_ref == p.tx_out_ref:
            own_txout = txi.resolved
    return own_txout 

def contract_utxo_count(txins: List[TxInInfo], addr: Address) -> int:
    count = 0
    for txi in txins:
        if txi.resolved.address == addr:
            count += 1
    assert count == 1, "Only 1 Utxo allowed"
    return count 

 if isinstance(purpose, Spending):
        own_utxo = own_spent_utxo(context.tx_info.inputs, purpose)
        own_addr = own_utxo.address
 count = contract_utxo_count(context.tx_info.inputs,own_addr)

[nielstron]

Looks good :)