feat: SourceStamp validation expects EIP-191 signature standard with …

…version byte 0x00
lens-protocol · Dec 19, 2024 · 8a35480 · 8a35480
1 parent 0b251d3
commit 8a35480
Showing 1 changed file with 19 additions and 5 deletions.
diff --git a/contracts/core/base/BaseSource.sol b/contracts/core/base/BaseSource.sol
@@ -6,19 +6,31 @@ import {ISource} from "./../interfaces/ISource.sol";
 import {SourceStamp} from "./../types/Types.sol";
 
 abstract contract BaseSource is ISource {
+    uint256 internal immutable EC_SIGNATURE_LENGTH = 65;
+    bytes2 internal immutable EIP191_VERSION_BYTE_0X00_HEADER = 0x1900;
+
     mapping(uint256 => bool) internal _wasSourceStampNonceUsed;
 
-    function validateSource(SourceStamp calldata sourceStamp) external virtual override {
+    function validateSource(
+        SourceStamp calldata sourceStamp
+    ) external virtual override {
         _validateSource(sourceStamp);
     }
 
-    function _validateSource(SourceStamp calldata sourceStamp) internal virtual {
+    // Signature Standard: EIP-191 - Version Byte: 0x45
+    function _validateSource(
+        SourceStamp calldata sourceStamp
+    ) internal virtual {
         require(!_wasSourceStampNonceUsed[sourceStamp.nonce]);
         require(sourceStamp.deadline >= block.timestamp);
         require(sourceStamp.source == address(this));
-        require(sourceStamp.signature.length == 65);
+        require(sourceStamp.signature.length == EC_SIGNATURE_LENGTH);
         _wasSourceStampNonceUsed[sourceStamp.nonce] = true;
-        bytes32 sourceStampHash = keccak256(abi.encode(sourceStamp.source, sourceStamp.nonce, sourceStamp.deadline));
+        bytes32 sourceStampHash = keccak256(
+            abi.encodePacked(
+                EIP191_VERSION_BYTE_0X00_HEADER, sourceStamp.source, sourceStamp.nonce, sourceStamp.deadline
+            )
+        );
         bytes32 r;
         bytes32 s;
         uint8 v;
@@ -32,5 +44,7 @@ abstract contract BaseSource is ISource {
         require(_isValidSourceStampSigner(signer));
     }
 
-    function _isValidSourceStampSigner(address signer) internal virtual returns (bool);
+    function _isValidSourceStampSigner(
+        address signer
+    ) internal virtual returns (bool);
 }