contract/dao/entrypoint/auth_xfer: check parent call is always dao exec

src/contract/dao/src/entrypoint/auth_xfer.rs

@@ -190,6 +190,12 @@ pub(crate) fn dao_authxfer_process_instruction(
     // Find this auth_call in the parent DAO::exec()
     let parent_idx = calls[call_idx].parent_index.unwrap();
     let exec_callnode = &calls[parent_idx];
+    if exec_callnode.data.contract_id != *DAO_CONTRACT_ID {
+        return Err(DaoError::AuthXferParentWrongContractId.into())
+    }
+    if exec_callnode.data.data[0] != DaoFunction::Exec as u8 {
+        return Err(DaoError::AuthXferParentWrongFunctionCode.into())
+    }
     let exec_params: DaoExecParams = deserialize(&exec_callnode.data.data[1..])?;
 
     let auth_call = find_auth_in_parent(exec_callnode, exec_params.proposal_auth_calls, call_idx);

src/contract/dao/src/error.rs

@@ -97,6 +97,12 @@ pub enum DaoError {
 
     #[error("Wrong output coin")]
     AuthXferWrongOutputCoin,
+
+    #[error("Parent contract ID is not dao::exec()")]
+    AuthXferParentWrongContractId,
+
+    #[error("Parent function code is not dao::exec()")]
+    AuthXferParentWrongFunctionCode,
 }
 
 impl From<DaoError> for ContractError {
@@ -128,6 +134,8 @@ impl From<DaoError> for ContractError {
             DaoError::AuthXferCallNotFoundInParent => Self::Custom(24),
             DaoError::AuthXferWrongNumberOutputs => Self::Custom(25),
             DaoError::AuthXferWrongOutputCoin => Self::Custom(26),
+            DaoError::AuthXferParentWrongContractId => Self::Custom(27),
+            DaoError::AuthXferParentWrongFunctionCode => Self::Custom(28),
         }
     }
 }