As I understand it, a "mangled" address can be used to spoof ownership of a wallet who's stake address is NOT of a wallet controlled by the one doing the spoofing.
Put another way: I can use someone else's address, and my own address, combined together to fool a dApp into dispensing some native assets to ME even though they should only be claimable by the owner of the wallet who's stake address I have mangled with my spending address.
What is a very concrete way for a dApp to NEVER fall prey to this "exploit"?
It is put this way on a thread I found:
It is not possible if the dApp does not send native assets to the address paying the fee, but instead to the address that last did a delegation of the stake key of the address paying the fee, which requires a signature of that stake key and, hence, guarantees the ownership.
what about a wallet that never delegated?
If someone uses a Franken Address to claim something or benefit somehow how can I make sure the TRUE owner is the one claiming/benefiting by finding the address to send to from the last time the stake address portion delegated? This must be a possible lookup in db-sync, and I am not sure how to look it up.
I am looking for a guaranteed way of ensuring native assets will (and ADA?) can only ever be sent to the actual wallet of the stake address, not to a wallet pretending to be that wallet by using a franken address.
I believe the simple way to avoid this as an issue is to ALWAYS require a user SIGN any transaction that sends them something or benefits them somehow...in this way, no spoofing is possible.