From a5324f483af8396f82e7852ad7756450d8fd55f8 Mon Sep 17 00:00:00 2001
From: ZhannaKom <zk@concordium.com>
Date: Wed, 28 Aug 2024 16:28:56 +0200
Subject: [PATCH 1/2] Fixed wallet checksum verification issue

---
 .../TokenLookup/CIS2Service.swift             | 31 +++++++++++++++++--
 1 file changed, 28 insertions(+), 3 deletions(-)

diff --git a/ConcordiumWallet/Views/AccountsView/AccountDetails/TokenLookup/CIS2Service.swift b/ConcordiumWallet/Views/AccountsView/AccountDetails/TokenLookup/CIS2Service.swift
index 7e6c2c15..5b0b2f8c 100644
--- a/ConcordiumWallet/Views/AccountsView/AccountDetails/TokenLookup/CIS2Service.swift
+++ b/ConcordiumWallet/Views/AccountsView/AccountDetails/TokenLookup/CIS2Service.swift
@@ -9,6 +9,7 @@
 import BigInt
 import Combine
 import Foundation
+import CryptoKit
 
 protocol CIS2ServiceProtocol {
     func fetchTokens(contractIndex: String, contractSubindex: String) -> AnyPublisher<CIS2TokensInfo, Error>
@@ -25,11 +26,16 @@ protocol CIS2ServiceProtocol {
     func fetchTokensMetadata(contractIndex: String, contractSubindex: String, tokenId: String) async throws -> CIS2TokensMetadata
     func fetchTokensBalance(contractIndex: String, contractSubindex: String, accountAddress: String, tokenId: String) async throws -> [CIS2TokenBalance]
     func deleteTokenFromCache(_ token: CIS2TokenSelectionRepresentable) throws
-    func fetchTokensMetadataDetails(url: URL) async throws -> CIS2TokenMetadataDetails
+    func fetchTokensMetadataDetails(url: URL, metadataChecksum: String?) async throws -> CIS2TokenMetadataDetails
     
     func getTokenMetadataPair(metadata: CIS2TokensMetadata) async throws -> [(CIS2TokensMetadataItem, CIS2TokenMetadataDetails)]
 }
 
+enum ChecksumError: Error {
+    case invalidChecksum
+    case incorrectChecksum
+}
+
 class CIS2Service: CIS2ServiceProtocol {
     let networkManager: NetworkManagerProtocol
     let storageManager: StorageManagerProtocol
@@ -188,9 +194,13 @@ extension CIS2Service {
         )
     }
     
-    func fetchTokensMetadataDetails(url: URL) async throws -> CIS2TokenMetadataDetails {
+    func fetchTokensMetadataDetails(url: URL, metadataChecksum: String?) async throws -> CIS2TokenMetadataDetails {
         let metadata: CIS2TokenMetadataDetails = try await networkManager.load(ResourceRequest(url: url))
         
+        if let metadataChecksum {
+            try await verifyChecksum(checksum: metadataChecksum, url: url)
+        }
+        
         try await MainActor.run {
             try self.storageManager.storeCIS2TokenMetadataDetails(metadata, for: url.absoluteString)
         }
@@ -216,7 +226,7 @@ extension CIS2Service {
             for metadata in metadata.metadata {
                 if let url = URL(string: metadata.metadataURL) {
                     group.addTask {
-                        guard let result = try? await self.fetchTokensMetadataDetails(url: url) else {
+                        guard let result = try? await self.fetchTokensMetadataDetails(url: url, metadataChecksum: metadata.metadataChecksum) else {
                             return nil
                         }
                         return (metadata, result)
@@ -229,4 +239,19 @@ extension CIS2Service {
                 .reduce(into: []) { $0.append($1) }
         }
     }
+    
+    /// Verifies the checksum of the response data against a provided checksum.
+    ///
+    /// - Parameters:
+    ///   - checksum: The expected checksum.
+    ///   - responseData: The data to verify.
+    /// - Throws: `ChecksumError.incorrectChecksum` if the checksums do not match.
+    func verifyChecksum(checksum: String, url: URL) async throws {
+        let (data, _) = try await URLSession(configuration: .ephemeral).data(from: url)
+        let hash = SHA256.hash(data: data)
+        let hashString = hash.compactMap { String(format: "%02x", $0) }.joined()
+        guard hashString.localizedCaseInsensitiveCompare(checksum) == .orderedSame else {
+            throw ChecksumError.incorrectChecksum
+        }
+    }
 }

From 6aa87dfdf896d0e868a761bce02cf01ea298afe3 Mon Sep 17 00:00:00 2001
From: ZhannaKom <zk@concordium.com>
Date: Wed, 4 Sep 2024 10:49:26 +0300
Subject: [PATCH 2/2] fixed test

---
 ConcordiumWallet/Views/UnshiedSunset/UnshiedSunsetView.swift | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/ConcordiumWallet/Views/UnshiedSunset/UnshiedSunsetView.swift b/ConcordiumWallet/Views/UnshiedSunset/UnshiedSunsetView.swift
index f8290e2a..f91c45fd 100644
--- a/ConcordiumWallet/Views/UnshiedSunset/UnshiedSunsetView.swift
+++ b/ConcordiumWallet/Views/UnshiedSunset/UnshiedSunsetView.swift
@@ -83,7 +83,3 @@ struct UnshiedSunsetView: View {
         }
     }
 }
-
-#Preview {
-    UnshiedSunsetView()
-}