Project
One World
NFTDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

The current order in _setDomainSeperator function is not in correct order according to the EIP-712 specification.

xmanuel

Summary

Vulnerability Details

According to EIP-712 specification Definition of domainSeparator:
The EIP712Domain fields should be the order as above, skipping any absent fields. Future field additions must be in alphabetical order and come after the above fields. User-agents should accept fields in any order as specified by the EIP712Domain type.

But this function is not in order, address(this) should be after bytes32(getChainId()) as per EIP-712 specification.

​
function _setDomainSeperator(string memory name, string memory version) internal {
domainSeperator = keccak256(
abi.encode(
EIP712_DOMAIN_TYPEHASH,
keccak256(bytes(name)),
keccak256(bytes(version)),
address(this),
bytes32(getChainId())
)
);
}

Impact

Signature Mismatch: The incorrect field order will generate a different domain separator than expected by tools and libraries that follow the EIP-712 standard,such as ethers.js, web3.js, or popular wallet applications like MetaMask. Meaning that signatures generated off-chain will not match the domain separator computed on-chain.

Incompatibility with User Agents: According to the EIP-712 spec, user agents (like wallets) should accept fields in any order, but they expect the encoding to follow the specified field order during hashing If the fields are not encoded in the correct order,signatures may be considered invalid, even if they were generated with the same private key and message.

Tools Used

manual

Recommendations

function _setDomainSeperator(string memory name, string memory version) internal {
domainSeperator = keccak256(
abi.encode(
EIP712_DOMAIN_TYPEHASH,
keccak256(bytes(name)),
keccak256(bytes(version)),
​
bytes32(getChainId())
address(this),
Updates

Lead Judging Commences

0xbrivan2 Lead Judge 9 months ago
Submission Judgement Published
Invalidated
Reason: Known issue

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.