WIP

lib/plugins.js

@@ -3,6 +3,7 @@
 var fs = require('fs')
 var R = require('ramda')
 var async = require('async')
+var HKDF = require('node-hkdf-sync')
 var BigNumber = require('bignumber.js')
 BigNumber.config({CRYPTO: true})
 
@@ -34,7 +35,7 @@ var idVerifierPlugin = null
 var infoPlugin = null
 var emailPlugin = null
 var smsPlugin = null
-var masterSeed = null
+var hkdf = null
 
 var currentlyUsedPlugins = {}
 
@@ -54,9 +55,9 @@ var coins = {
 var alertFingerprint = null
 var lastAlertTime = null
 
-// that's basically a constructor
 exports.init = function init () {
-  fs.readFileSync('seeds/seed.txt')
+  const masterSeed = fs.readFileSync('seeds/seed.txt').trim()
+  hkdf = new HKDF('sha256', 'lamassu-server-salt', masterSeed)
 }
 
 function loadPlugin (name, config) {
@@ -175,15 +176,15 @@ exports.configure = function configure (config) {
       }
     )
 
-    // WALLET [required] configure (or load)
+    // Give each crypto a different derived seed so as not to allow any
+    // plugin to spend another plugin's funds
+    const cryptoSeed = hkdf.derive(cryptoCode, 32)
+
     loadOrConfigPlugin(
       walletPlugins[cryptoCode],
       'transfer',
       cryptoCode,
-      {
-        nextCashOutSerialHD: db.nextCashOutSerialHD(cryptoCode),
-        masterSeed: masterSeed
-      },
+      {masterSeed: cryptoSeed},
       function onWalletChange (newWallet) {
         walletPlugins[cryptoCode] = newWallet
         pollBalance(cryptoCode)
@@ -348,27 +349,25 @@ exports.sendCoins = function sendCoins (session, rawTx) {
 }
 
 exports.cashOut = function cashOut (session, tx) {
-  var tmpInfo = {
-    label: 'TX ' + Date.now(),
-    account: 'deposit'
-  }
-
   var cryptoCode = tx.cryptoCode || 'BTC'
   var walletPlugin = walletPlugins[cryptoCode]
 
-  return new Promise((resolve, reject) => {
+  return db.nextCashOutSerialHD(tx.sessionId, cryptoCode)
+  .then(serialNumber => new Promise((resolve, reject) => {
+    const tmpInfo = {
+      label: 'TX ' + Date.now(),
+      account: 'deposit',
+      serialNumber: serialNumber
+    }
+
     walletPlugin.newAddress(tmpInfo, function (err, address) {
       if (err) return reject(err)
 
-      const addressRec = R.is(String, address)
-      ? {address: address}
-      : address
-
-      const newTx = R.assoc('toAddress', addressRec.address, tx)
-      return db.addInitialIncoming(session, newTx, addressRec)
+      const newTx = R.assoc('toAddress', address, tx)
+      return db.addInitialIncoming(session, newTx, address)
       .then(() => resolve(address))
     })
-  })
+  }))
 }
 
 exports.dispenseAck = function dispenseAck (session, rec) {