Prevent sanctioned addresses and countries from connecting to mondo.

next-env.d.ts

@@ -2,4 +2,4 @@
 /// <reference types="next/image-types/global" />
 
 // NOTE: This file should not be edited
-// see https://nextjs.org/docs/basic-features/typescript for more information.
+// see https://nextjs.org/docs/app/building-your-application/configuring/typescript for more information.

package.json

@@ -16,6 +16,7 @@
   "homepage": "https://github.com/celo-org/celo-mondo",
   "dependencies": {
     "@celo/abis": "^11.0.0",
+    "@celo/compliance": "^1.0.23",
     "@headlessui/react": "^1.7.18",
     "@metamask/jazzicon": "https://github.com/jmrossy/jazzicon#7a8df28974b4e81129bfbe3cab76308b889032a6",
     "@metamask/post-message-stream": "6.1.2",

src/app/app.tsx

@@ -6,6 +6,7 @@ import 'react-toastify/dist/ReactToastify.css';
 import { ErrorBoundary } from 'src/components/errors/ErrorBoundary';
 import { Footer } from 'src/components/nav/Footer';
 import { Header } from 'src/components/nav/Header';
+import { LegalRestrict } from 'src/components/police';
 import { WagmiContext } from 'src/config/wagmi';
 import { TransactionModal } from 'src/features/transactions/TransactionModal';
 import { useIsSsr } from 'src/utils/ssr';
@@ -17,7 +18,9 @@ export function App({ children }: PropsWithChildren<any>) {
     <ErrorBoundary>
       <SafeHydrate>
         <WagmiContext>
-          <BodyLayout>{children}</BodyLayout>
+          <LegalRestrict>
+            <BodyLayout>{children}</BodyLayout>
+          </LegalRestrict>
           <TransactionModal />
           <ToastContainer transition={Zoom} position="bottom-right" />
         </WagmiContext>

src/app/police/route.ts

@@ -0,0 +1,36 @@
+import { headers } from 'next/headers';
+import { NextResponse, type NextRequest } from 'next/server';
+
+export function GET(request: NextRequest) {
+  const headerList = headers();
+
+  const country = request.geo?.country || (headerList.get('x-vercel-ip-country') as string);
+  const region = request.geo?.region || (headerList.get('x-vercel-ip-country-region') as string);
+
+  console.info('country', country, region);
+
+  if (isForbiddenLand(country, region)) {
+    return new NextResponse(null, { status: 451 });
+  }
+
+  return new NextResponse(null, { status: 202 });
+}
+// TODO allow Poland after testing
+const RESTRICTED_COUNTRIES = new Set(['KP', 'IR', 'CU', 'SY', 'PL']);
+
+// https://www.iso.org/obp/ui/#iso:code:3166:UA although listed with UA prefix. the header/api recieved that and just used the number
+const crimea = '43';
+const luhansk = '09';
+const donetska = '14';
+//https://en.wikipedia.org/wiki/Russian-occupied_territories_of_Ukraine
+const RESTRICED_SUBREGION: Record<string, Set<string>> = {
+  UA: new Set([crimea, luhansk, donetska]),
+};
+
+function isForbiddenLand(iso3166Country: string, iso3166Region: string) {
+  const iso3166CountryUppercase = iso3166Country?.toUpperCase();
+  return (
+    RESTRICTED_COUNTRIES.has(iso3166CountryUppercase) ||
+    RESTRICED_SUBREGION[iso3166CountryUppercase]?.has(iso3166Region)
+  );
+}

src/components/police.tsx

@@ -0,0 +1,55 @@
+import { OFAC_SANCTIONS_LIST_URL, SANCTIONED_ADDRESSES } from '@celo/compliance';
+import { PropsWithChildren, useEffect } from 'react';
+import { readFromCache, writeToCache } from 'src/utils/localSave';
+import { useAccount, useDisconnect } from 'wagmi';
+
+export function LegalRestrict(props: PropsWithChildren) {
+  usePolice();
+  return props.children;
+}
+
+function usePolice() {
+  const { address, isConnected } = useAccount();
+  const { disconnect } = useDisconnect();
+
+  useEffect(() => {
+    if (isConnected && address) {
+      isSanctionedAddress(address).then((isSanctioned) => {
+        if (isSanctioned) {
+          disconnect();
+          alert('The Address is under OFAC Sanctions');
+        }
+      });
+      fetch('/police').then((response) => {
+        if (response.status === 451) {
+          disconnect();
+          alert('The Region is under Sanction');
+        }
+      });
+    }
+  }, [isConnected, address, disconnect]);
+}
+
+const DAY = 24 * 60 * 60 * 1000;
+
+export async function isSanctionedAddress(address: string): Promise<boolean> {
+  const cache = readFromCache(OFAC_SANCTIONS_LIST_URL);
+  if (cache && cache.ts + DAY > Date.now()) {
+    return cache.data.includes(address.toLowerCase());
+  }
+
+  const sanctionedAddresses: string[] = await fetch(OFAC_SANCTIONS_LIST_URL)
+    .then((x) => x.json())
+    .catch(() => SANCTIONED_ADDRESSES); // fallback if github is down or something.
+
+  if (process.env.NODE_ENV !== 'production' && process.env.TEST_SANCTIONED_ADDRESS) {
+    sanctionedAddresses.push(process.env.TEST_SANCTIONED_ADDRESS);
+  }
+
+  writeToCache(
+    OFAC_SANCTIONS_LIST_URL,
+    sanctionedAddresses.map((x) => x.toLowerCase()),
+  );
+
+  return isSanctionedAddress(address);
+}

src/utils/localSave.ts

@@ -0,0 +1,12 @@
+export const writeToCache = (url: string, data: string[]) =>
+  localStorage.setItem(url, JSON.stringify({ ts: Date.now(), data }));
+
+export const deleteFromCache = (url: string) => localStorage.removeItem(url);
+
+export const readFromCache = (url: string) => {
+  const cached = localStorage.getItem(url);
+  if (cached) {
+    return JSON.parse(cached) as { ts: number; data: string[] };
+  }
+  return null;
+};

yarn.lock

@@ -461,6 +461,7 @@ __metadata:
   resolution: "@celo-mondo/celo-mondo-web@workspace:."
   dependencies:
     "@celo/abis": "npm:^11.0.0"
+    "@celo/compliance": "npm:^1.0.23"
     "@headlessui/react": "npm:^1.7.18"
     "@metamask/jazzicon": "https://github.com/jmrossy/jazzicon#7a8df28974b4e81129bfbe3cab76308b889032a6"
     "@metamask/post-message-stream": "npm:6.1.2"
@@ -521,6 +522,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@celo/compliance@npm:^1.0.23":
+  version: 1.0.23
+  resolution: "@celo/compliance@npm:1.0.23"
+  checksum: 10/3b67363e4fd266d03fdecfd3dd6ad17b0328c235d79522eea6c815864d7be5fd0aba6accb2b63dd78cc2ec2ec07ed8c85de8a282b8de60c9bd1cd72ff09c01bd
+  languageName: node
+  linkType: hard
+
 "@coinbase/wallet-sdk@npm:4.0.4":
   version: 4.0.4
   resolution: "@coinbase/wallet-sdk@npm:4.0.4"