title: How to check what contract is running for a transaction in the flow?
body: <p>I have a state <code>SomeBond</code> which i want to issue and transact with on a Corda network. When a participant A is transferring a <code>SomeBond</code> state to participant B, the expectation is that either A got the state from X, or A was issued <code>SomeBond</code> (by let's say Y).</p>
  
  <p>To verify this, B runs the contracts associated with all the states in the transaction. The expected contract is <code>SomeBondContract</code>, but B isn't assured that it will be run. To be sure that the states in this transaction ARE going to run <code>SomeBondContract</code>, he'll have to actually put in a check in the flow before signing. </p>
  
  <pre><code>val outputsLegit = stx.tx.outputs.all { it.contract == "com.example.SomeBondContract" }
  val inputsLegit = stx.tx.toLedgerTransaction(serviceHub).inputs.all { it.state.contract == "com.example.SomeBondContract" }
  </code></pre>
  
  <p>But if he puts a check just in the flow then it'll only validate the current transaction. We still can't be sure that the previous transaction, where C sent the state to A had the same contract assigned to its input state. Maybe it went something like this:</p>
  
  <p>C creates a transaction (101):</p>
  
  <blockquote>
    <p>Input (Empty)</p>
    
    <p>Output: <code>SomeBondState</code>, Contract ID: <code>com.example.EmptyContract</code></p>
  </blockquote>
  
  <p>And then creates transaction (102):</p>
  
  <blockquote>
    <p>Input: 101[0]</p>
    
    <p>Output: <code>SomeBondState</code>, Contract ID: <code>com.example.SomeBondContract</code></p>
  </blockquote>
  
  <p>And uses the output of this transaction (i.e. 102[0]) as the input of a transfer to B.
  The problem here is the C was never a legit issuer for the <code>SomeBondState</code>, and the transaction was never supposed to have happened, but since he assigned a faulty contract to the state, he created it without problems.</p>
  
  <p>A way to prevent this would be to put the same check in the contract as well. That way, the flow can check if the current transaction has the contracts assigned to its states, and the contract itself can check that the input state has the contract assigned. That way, transaction 102 would never succeed since it has an input that is of type <code>SomeBondState</code> but doesn't have a <code>com.example.SomeBondState</code> as the contract. Since the dependency graph is recursively verified till an issue, even faulty nodes will not be able to pass off a fake state as real.</p>
  
  <p>Of course, a simpler way is to ensure that there's no <code>EmptyContract</code> in the jar, but there might be subtler misuse of any existing contract to slip through unwanted states. I'm just using <code>EmptyContract</code> as an example.</p>
  
  <p>But checking for a package name in flows and Contracts seems a little unsafe and hacky. I don't exactly understand how class loaders work and how two identical class names with the same package name would be handled and if there are ways for a malicious node to do stuff.</p>
  
  <p>Also, i don't really understand why we are being asked to bind a contract to a state while building a transaction? Why can't Contracts be bound to states inside the state definition itself? Maybe a state can be annotated with its associated contract? Was it so that different contracts can be used with the same state at different times? But isn't that kinda what commands are for? So that the same contract can behave differently at different times?</p>
  
  <p>Or is my whole concern of "how do i ensure the right contract is running on a transaction" missing something? Thanks in advance for the answer.</p>