From 6d939997908b8ea7090202bf0ee78767b01b7c4b Mon Sep 17 00:00:00 2001
From: dk1a <dk1a@protonmail.com>
Date: Thu, 16 May 2024 14:31:51 +0300
Subject: [PATCH] check for maybe EOA at start and spawn

---
 packages/contracts/src/libraries/LibUtils.sol            | 9 +++++++++
 .../contracts/src/systems/progression/SpawnSystem.sol    | 1 +
 .../contracts/src/systems/progression/StartSystem.sol    | 2 ++
 3 files changed, 12 insertions(+)

diff --git a/packages/contracts/src/libraries/LibUtils.sol b/packages/contracts/src/libraries/LibUtils.sol
index 4d7f58cf..c05b8614 100644
--- a/packages/contracts/src/libraries/LibUtils.sol
+++ b/packages/contracts/src/libraries/LibUtils.sol
@@ -137,4 +137,13 @@ library LibUtils {
     }
     return false;
   }
+
+  /**
+   * @dev Only meant as a temporary measure:
+   * can be circumvented (although it's harder if the check is used across 2+ txs),
+   * and doesn't combine well with account abstraction
+   */
+  function isMaybeEOA(address target) internal view returns (bool) {
+    return target.code.length == 0;
+  }
 }
diff --git a/packages/contracts/src/systems/progression/SpawnSystem.sol b/packages/contracts/src/systems/progression/SpawnSystem.sol
index 062ecb31..f44b8ca3 100644
--- a/packages/contracts/src/systems/progression/SpawnSystem.sol
+++ b/packages/contracts/src/systems/progression/SpawnSystem.sol
@@ -12,6 +12,7 @@ contract SpawnSystem is System {
    */
   function spawn(string memory _name) public returns (bytes32 playerEntity) {
     require(!LibUtils.stringEq(_name, ""), "name empty");
+    require(LibUtils.isMaybeEOA(_msgSender()), "sender not EOA");
 
     playerEntity = LibUtils.addressToEntityKey(_msgSender());
 
diff --git a/packages/contracts/src/systems/progression/StartSystem.sol b/packages/contracts/src/systems/progression/StartSystem.sol
index d71a327f..823cd3b7 100644
--- a/packages/contracts/src/systems/progression/StartSystem.sol
+++ b/packages/contracts/src/systems/progression/StartSystem.sol
@@ -13,6 +13,8 @@ contract StartSystem is System {
    * @return podEntity Id of pod entity
    */
   function start() public returns (bytes32 podEntity) {
+    require(LibUtils.isMaybeEOA(_msgSender()), "sender not EOA");
+
     bytes32 playerEntity = LibUtils.addressToEntityKey(_msgSender());
 
     // todo: check that player is spawned