address comments

Author: nialexsan

cadence/contracts/TidalYield.cdc

@@ -320,6 +320,10 @@ access(all) contract TidalYield {
         }
         /// Creates a new Tide executing the specified Strategy with the provided funds
         access(all) fun createTide(betaRef: auth(TidalYieldClosedBeta.Beta) &TidalYieldClosedBeta.BetaBadge, strategyType: Type, withVault: @{FungibleToken.Vault}) {
+            pre {
+                TidalYieldClosedBeta.validateBeta(self.owner?.address!, betaRef):
+                "Invalid Beta Ref"
+            }
             let balance = withVault.balance
             let type = withVault.getType()
             let tide <-create Tide(strategyType: strategyType, withVault: <-withVault)
@@ -341,6 +345,9 @@ access(all) contract TidalYield {
             pre {
                 self.tides[tide.uniqueID.id] == nil:
                 "Collision with Tide ID \(tide.uniqueID.id) - a Tide with this ID already exists"
+
+                TidalYieldClosedBeta.validateBeta(self.owner?.address!, betaRef):
+                "Invalid Beta Ref"
             }
             emit AddedToManager(id: tide.uniqueID.id, owner: self.owner?.address, managerUUID: self.uuid, tokenType: tide.getType().identifier)
             self.tides[tide.uniqueID.id] <-! tide
@@ -350,6 +357,9 @@ access(all) contract TidalYield {
             pre {
                 self.tides[id] != nil:
                 "No Tide with ID \(id) found"
+
+                TidalYieldClosedBeta.validateBeta(self.owner?.address!, betaRef):
+                "Invalid Beta Ref"
             }
             let tide = (&self.tides[id] as &Tide?)!
             tide.deposit(from: <-from)
@@ -366,6 +376,9 @@ access(all) contract TidalYield {
             pre {
                 self.tides[id] != nil:
                 "No Tide with ID \(id) found"
+
+                TidalYieldClosedBeta.validateBeta(self.owner?.address!, betaRef):
+                "Invalid Beta Ref"
             }
             return <- self._withdrawTide(id: id)!
         }

cadence/contracts/TidalYieldClosedBeta.cdc

@@ -4,12 +4,12 @@ access(all) contract TidalYieldClosedBeta {
     access(all) entitlement Beta
 
     access(all) resource BetaBadge {
-        access(all) let _owner: Address
-        init(_ o: Address) {
-            self._owner = o
+        access(all) let assignedTo: Address
+        init(_ addr: Address) {
+            self.assignedTo = addr
         }
         access(all) view fun getOwner(): Address {
-            return self._owner
+            return self.assignedTo
         }
     }
 
@@ -103,6 +103,27 @@ access(all) contract TidalYieldClosedBeta {
         return nil
     }
 
+    access(all) view fun validateBeta(_ addr: Address?, _ betaRef: auth(Beta) &BetaBadge): Bool {
+        if (addr == nil) {
+            return false
+        }
+        // Must have a live, non-revoked record for this address
+        let recordedID: UInt64? = self.getBetaCapID(addr!); 
+        if recordedID == nil {
+            return false
+        }
+
+        if self.issuedCapIDs[addr!]?.isRevoked == true {
+            return false
+        }
+
+        if betaRef.getOwner() != addr {
+            return false
+        }
+
+        return true 
+    }
+
     init() {
         self.AdminHandleStoragePath = StoragePath(
             identifier: "TidalYieldClosedBetaAdmin_\(self.account.address)"

cadence/transactions/tidal-yield/admin/grant_beta.cdc

@@ -8,12 +8,9 @@ transaction() {
         admin: auth(Capabilities) &Account,
         user:  auth(Storage, Capabilities) &Account
     ) {
-        let adminCap: Capability<auth(TidalYieldClosedBeta.Admin) &TidalYieldClosedBeta.AdminHandle> =
-            admin.capabilities.storage.issue<auth(TidalYieldClosedBeta.Admin) &TidalYieldClosedBeta.AdminHandle>(
-                TidalYieldClosedBeta.AdminHandleStoragePath
-            )
-        let handle: auth(TidalYieldClosedBeta.Admin) &TidalYieldClosedBeta.AdminHandle =
-            adminCap.borrow() ?? panic("Missing AdminHandle")
+        let handle = admin.storage.borrow<auth(TidalYieldClosedBeta.Admin) &TidalYieldClosedBeta.AdminHandle>(
+            from: TidalYieldClosedBeta.AdminHandleStoragePath
+        ) ?? panic("Missing AdminHandle")
 
         let cap: Capability<auth(TidalYieldClosedBeta.Beta) &TidalYieldClosedBeta.BetaBadge> =
             handle.grantBeta(addr: user.address)