Hello. My team and I are building a policy builder on top of OZ Smart Accounts on Stellar, and while researching we hit a couple of things I wanted to check with you.
We were looking at whether spending_limit could constrain a Blend claim(). Two separate things came up:
spending_limitonly meters transfer contexts and installs onCallContract. Its enforce rejects any non-transfer context withNotAllowed, so it can't be used to allow-and-cap aclaim(). it would deny the claim outright.- The claimed amount is the return value of
claim(), not an argument, so nothing at authorization time can read it. Amax_claim_amountcap just isn't enforceable for a claim.
So we ended up writing a custom claim-scoped policy and enforcing to== smart_accountas the real safety property, since the actual loophole is an agent redirecting the yield, not claiming too much.
I wanted to know: is a custom claim-scoped policy the intended pattern here, or is there a composition we're missing?