As I understand it, a "mangled" address can be used to spoof ownership of a wallet who's stake address is NOT of a wallet controlled by the one doing the spoofing.

Put another way: I can use someone else's address, and my own address, combined together to fool a dApp into dispensing some native assets to ME even though they should only be claimable by the owner of the wallet who's stake address I have mangled with my spending address.

What is a very concrete way for a dApp to NEVER fall prey to this "exploit"?

It is put this way on a thread I found:

It is not possible if the dApp does not send native assets to the address paying the fee, but instead to the address that last did a delegation of the stake key of the address paying the fee, which requires a signature of that stake key and, hence, guarantees the ownership.

So...

1. what about a wallet that never delegated?

2. If someone uses a Franken Address to claim something or benefit somehow how can I make sure the TRUE owner is the one claiming/benefiting by finding the address to send to from the last time the stake address portion delegated? This must be a possible lookup in db-sync, and I am not sure how to look it up.

I am looking for a guaranteed way of ensuring native assets will (and ADA?) can only ever be sent to the actual wallet of the stake address, not to a wallet pretending to be that wallet by using a franken address.

As I understand it, a "mangled" address can be used to spoof ownership of a wallet who's stake address is NOT of a wallet controlled by the one doing the spoofing.

Put another way: I can use someone else's address, and my own address, combined together to fool a dApp into dispensing some native assets to ME even though they should only be claimable by the owner of the wallet who's stake address I have mangled with my spending address.

What is a very concrete way for a dApp to NEVER fall prey to this "exploit"?

It is put this way on a thread I found:

It is not possible if the dApp does not send native assets to the address paying the fee, but instead to the address that last did a delegation of the stake key of the address paying the fee, which requires a signature of that stake key and, hence, guarantees the ownership.

So...

1. what about a wallet that never delegated?

2. If someone uses a Franken Address to claim something or benefit somehow how can I make sure the TRUE owner is the one claiming/benefiting by finding the address to send to from the last time the stake address portion delegated? This must be a possible lookup in db-sync, and I am not sure how to look it up.

I am looking for a guaranteed way of ensuring native assets will (and ADA?) can only ever be sent to the actual wallet of the stake address, not to a wallet pretending to be that wallet by using a franken address.

I believe the simple way to avoid this as an issue is to ALWAYS require a user SIGN any transaction that sends them something or benefits them somehow...in this way, no spoofing is possible.

As I understand it, a "mangled" address can be used to spoof ownership of a wallet who's stake address is NOT of a wallet controlled by the one doing the spoofing.

Owner A has Stake Address A and spending address a. Owner B has Stake Address B and spending address b. Owner A is owed some native assets by a dApp.

The dApp dispenses what's owed to the the stake address derived from their used/unused spending address which submits payment for claiming the tokens.

So...owner B spoofs Owner A's wallet in the dApp by sending from an address that is made by combining Owner A's stake address 'A' with their own spending address 'b'.

So now even though only the "real" owner 'Aa' should be able to claim, the "fake" owner 'Ab' can claim BECAUSE the dApp dispenses to the payment address of 'Ab' rather than to the stake address A.

If you read this far thank you. Put another way: I can use someone else's stake address, and my own spending address to fool a dApp into dispensing some native assets to ME even though they should only be claimable by the owner of the wallet who's stake address I have mangled with my spending address.

THIS...means..there is a very concrete way for a dApp to NEVER fall prey to this "exploit" =>

It is put this way on a thread I found:

It is not possible if the dApp does not send native assets to the address paying the fee, but instead to the address that last did a delegation of the stake key of the address paying the fee, which requires a signature of that stake key and, hence, guarantees the ownership.

So...in the interest of always applying good practice in the future:

1. what about a wallet that never delegated?

2. If someone uses a Franken Address to claim something or benefit somehow how can I make sure the TRUE owner is the one claiming/benefiting by finding the address to send to from the last time the stake address portion delegated? This must be a possible lookup in db-sync, and I am not sure how to look it up.

I would like to always ensure I am sending or benefitting the TRUE owner, not someone spoofing their wallet by using a franken address that includes their stake address when using the dApp.

As I understand it, a "mangled" address can be used to spoof ownership of a wallet who's stake address is NOT of a wallet controlled by the one doing the spoofing.

Put another way: I can use someone else's address, and my own address, combined together to fool a dApp into dispensing some native assets to ME even though they should only be claimable by the owner of the wallet who's stake address I have mangled with my spending address.

What is a very concrete way for a dApp to NEVER fall prey to this "exploit"?

It is put this way on a thread I found:

It is not possible if the dApp does not send native assets to the address paying the fee, but instead to the address that last did a delegation of the stake key of the address paying the fee, which requires a signature of that stake key and, hence, guarantees the ownership.

So...

1. what about a wallet that never delegated?

2. If someone uses a Franken Address to claim something or benefit somehow how can I make sure the TRUE owner is the one claiming/benefiting by finding the address to send to from the last time the stake address portion delegated? This must be a possible lookup in db-sync, and I am not sure how to look it up.

I am looking for a guaranteed way of ensuring native assets will (and ADA?) can only ever be sent to the actual wallet of the stake address, not to a wallet pretending to be that wallet by using a franken address.