0

I am developing a dApp where a user can send a few ada (3) to an address that I am listening to on my backend server, and I send a few tokens back depending on what NFTs they have in the wallet. When the transaction is received, I get the stake key from the sender's address using the Blockfrost API and read all assets they control. I then calculate how many tokens they are owed and send those to them.

I have seen mangled addresses mentioned a few times when developing, but I'm still struggling to wrap my head around them or understand if they would affect my app. Any insight would be much appreciated.

Improve this question

2 Answers 2

Reset to default
3

A Cardano/ADA address consists of two components; a spending credential and a staking credential.

By default, the spending and staking credential are derived from the same private key. However it is also possible to create an address from spending and staking credentials from different private keys. This is a mangled address.

For these mangled addresses, the ADA attached to the spending credential is what determines how much staking rewards are earned, but any rewards accruing due to this ADA can only be spent by the holder of the private key that generated the staking credential.

Improve this answer
1

And specifically to your question (and continuing from Erik's answer), yes this can potentially affect your app. The issue is that since the address may be one of these mangled (or "frankenstein") addresses, if you naively send the rewards to this address they may not be going to the intended person.
One method some people use is to check for the first registration of the staking address, which should normally be by the "real" owner.

Improve this answer
4
  • What do you mean by the "first registration" and are there any common methods of checking that?
    – 0x6f6b
    Commented Jul 20, 2023 at 11:08
  • 1
    In provider's like blockfrost, when you want to receive list of addresses having a particular staking part, it allows giving this list, sorted with time it first appeared on chain. See docs.blockfrost.io/#tag/Cardano-Accounts/paths/….
    – Sourabh
    Commented Jul 24, 2023 at 4:00
  • 1
    Ok, so if I use the "accounts/{stake_address}/addresses" endpoint and send rewards to the oldest address in the list, I will be safer. Is there any risk that when I use the "accounts/{stake_address}/addresses/assets" endpoint it will return assets that the account doesn't own?
    – 0x6f6b
    Commented Jul 27, 2023 at 12:09
  • yes but only the real owner of the tokens could spoof them to another staking address, which makes no sense for him
    – wutzebaer
    Commented Aug 16, 2023 at 23:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.