From c606b455d62b62b28465acaa915c4a781967f07f Mon Sep 17 00:00:00 2001
From: Mark Spanbroek <mark@spanbroek.net>
Date: Tue, 22 Mar 2022 11:39:45 +0100
Subject: [PATCH] Disallow starting an offer that was not selected

---
 contracts/Marketplace.sol | 10 +++++++---
 contracts/Storage.sol     |  1 +
 test/Storage.test.js      |  9 +++++++++
 3 files changed, 17 insertions(+), 3 deletions(-)

diff --git a/contracts/Marketplace.sol b/contracts/Marketplace.sol
index 65aaf19..ef26468 100644
--- a/contracts/Marketplace.sol
+++ b/contracts/Marketplace.sol
@@ -67,9 +67,9 @@ contract Marketplace is Collateral {
     require(request.client == msg.sender, "Only client can select offer");
 
     RequestState storage state = requestState[offer.requestId];
-    require(!state.offerSelected, "Offer already selected");
+    require(state.selectedOffer == bytes32(0), "Offer already selected");
 
-    state.offerSelected = true;
+    state.selectedOffer = id;
 
     _createLock(id, offer.expiry);
     _lock(offer.host, id);
@@ -91,6 +91,10 @@ contract Marketplace is Collateral {
     return offers[id];
   }
 
+  function _selectedOffer(bytes32 requestId) internal view returns (bytes32) {
+    return requestState[requestId].selectedOffer;
+  }
+
   struct Request {
     address client;
     uint256 duration;
@@ -103,7 +107,7 @@ contract Marketplace is Collateral {
   }
 
   struct RequestState {
-    bool offerSelected;
+    bytes32 selectedOffer;
   }
 
   struct Offer {
diff --git a/contracts/Storage.sol b/contracts/Storage.sol
index 38aeb00..caf495c 100644
--- a/contracts/Storage.sol
+++ b/contracts/Storage.sol
@@ -32,6 +32,7 @@ contract Storage is Collateral, Marketplace, Proofs {
   function startContract(bytes32 id) public {
     Offer storage offer = _offer(id);
     require(msg.sender == offer.host, "Only host can call this function");
+    require(_selectedOffer(offer.requestId) == id, "Offer was not selected");
     Request storage request = _request(offer.requestId);
     _expectProofs(id, request.proofProbability, request.duration);
   }
diff --git a/test/Storage.test.js b/test/Storage.test.js
index a9dd1eb..235ad1e 100644
--- a/test/Storage.test.js
+++ b/test/Storage.test.js
@@ -70,6 +70,15 @@ describe("Storage", function () {
       await storage.startContract(id)
       await expect(storage.startContract(id)).to.be.reverted
     })
+
+    it("can only be done for a selected offer", async function () {
+      switchAccount(host)
+      const differentOffer = { ...offer, price: offer.price * 2 }
+      await storage.offerStorage(differentOffer)
+      await expect(
+        storage.startContract(offerId(differentOffer))
+      ).to.be.revertedWith("Offer was not selected")
+    })
   })
 
   describe("finishing the contract", function () {