Accept only vote with voting power (snapshot-labs#46)

jsertx · Apr 14, 2021 · 0ee2ca6 · 0ee2ca6
1 parent 0b0e27b
commit 0ee2ca6
Showing 1 changed file with 20 additions and 1 deletion.
diff --git a/server/writer/vote.ts b/server/writer/vote.ts
@@ -1,3 +1,5 @@
+import snapshot from '@snapshot-labs/snapshot.js';
+import { spaces } from '../helpers/spaces';
 import { jsonParse } from '../helpers/utils';
 import { getProposal, storeVote } from '../helpers/adapters/mysql';
 
@@ -20,11 +22,28 @@ export async function verify(body): Promise<any> {
 
   const proposal = await getProposal(msg.space, msg.payload.proposal);
   if (!proposal) return Promise.reject('unknown proposal');
-  const payload = jsonParse(proposal.payload);
 
+  const payload = jsonParse(proposal.payload);
   const msgTs = parseInt(msg.timestamp);
   if (msgTs > payload.end || payload.start > msgTs)
     return Promise.reject('not in voting window');
+
+  const space = spaces[msg.space];
+  try {
+    const scores = await snapshot.utils.getScores(
+      msg.space,
+      space.strategies,
+      space.network,
+      snapshot.utils.getProvider(space.network),
+      [body.address]
+    );
+    const totalScore = scores
+      .map((score: any) => Object.values(score).reduce((a, b: any) => a + b, 0))
+      .reduce((a, b: any) => a + b, 0);
+    if (totalScore === 0) return Promise.reject('no voting power');
+  } catch (e) {
+    return Promise.reject('failed to check voting power');
+  }
 }
 
 export async function action(