Project

Summary

The executeMetaTransaction function does not hash the functionSignature before encoding, which is a deviation from EIP-712 standards. EIP-712 specifies that dynamic values, such as bytes and strings, are encoded as a kecca256 hash of their contents, ensuring a consistent, fixed-size input for cryptographic functions. This oversight may lead to issues with signature validation and non-standard behavior.

Vulnerability Details

The code in question is;

Here, functionSignature is directly encoded without hashing, even though it is a bytes type—a dynamic value. EIP-712 guidelines require that dynamic values like bytes be hashed first to produce a fixed-size, bytes32 value before encoding.

Impact

Non-compliance with EIP712 can cause problems with integrators and potentially lead to denial of service.

Tools Used

Manual Review

Recommendations

To ensure compliance with EIP-712, the revised standard should be;