[tgrade-valset] Metadata issues

[maurolacy]

During #42, noticed a number of relatively small issues with metadata handling in tgrade-valset:

• Metadata validation is almost nil. Only moniker is validated, and for minimum length. Let's add validation for max length over all string fields, with some reasonable values. There will be a max length that is enforced by the vm, but that length can be very large for a string field (128 Kb or more).
• Metadata is not validated during instantiation.
• The sender is not validated during metadata update. That means anybody can overwrite the metadata of an operator.
• The sender is not validated during validator key registration. That means anybody can register a public key and associated metadata for an operator. Perhaps this is the intended feature, as this registration method can only used for setting a pubkey, not updating one.

[ethanfrey]

Let's validate all this. Good points.

[ueco-jb]

@maurolacy

The sender is not validated during metadata update. That means anybody can overwrite the metadata of an operator.

https://github.com/confio/poe-contracts/blob/main/contracts/tgrade-valset/src/contract.rs#L239

operators().update(deps.storage, &info.sender, |info| match info {

update() searches using key, which here is info.sender. Unless I'm missing something, that means sender may update only his own metadata - if he's already in operators() list.

[maurolacy]

update() searches using, which here is info.sender. Unless I'm missing something, that means sender may update only his own metadata - if he's already in operators() list.

Good. Missed that; was looking for the typical auth pattern I guess.

[ethanfrey]

The sender is not validated during validator key registration. That means anybody can register a public key and associated metadata for an operator. Perhaps this is the intended feature, as this registration method can only used for setting a pubkey, not updating one

Please check this. I think this is handled the same way as update (sender set their own key)

[ethanfrey]

Metadata validation is almost nil. Only moniker is validated, and for minimum length. Let's add validation for max length over all string fields, with some reasonable values. There will be a max length that is enforced by the vm, but that length can be very large for a string field (128 Kb or more).

I think max length of 256 or so should be plenty. You can make it a bit bigger if you think for some fields

[ueco-jb]

Please check this. I think this is handled the same way as update (sender set their own key)

Yup.

    let pubkey: Ed25519Pubkey = pubkey.try_into()?;
    let operator = OperatorInfo {
...
    match operators().may_load(deps.storage, &info.sender)? {
        Some(_) => return Err(ContractError::OperatorRegistered {}),
        None => operators().save(deps.storage, &info.sender, &operator)?,
    };