Skip to content

Latest commit

 

History

History
26 lines (19 loc) · 1000 Bytes

File metadata and controls

26 lines (19 loc) · 1000 Bytes

Festive Flaxen Raccoon

Medium

wrong implement of "_verifySignature" in MetaQuantsFactory

Summary

As we are calling verifySignature function to verify the signature and we are calling the ECDSA.toEthSignedMessageHash function but there is no function like it.

Vulnerability Detail

As we can go through the below link we can see that the other is no function like toEthSignedMessageHash in ECDSA. https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/utils/cryptography/ECDSA.sol

function _verifySignature(bytes memory updateData, bytes memory signature) private view returns (bool) { return signer == ECDSA.recover(ECDSA.toEthSignedMessageHash(updateData), signature); } }

Impact

Code Snippet

https://github.com/sherlock-audit/2024-08-perennial-v2-update-3/blob/main/perennial-v2/packages/perennial-oracle/contracts/metaquants/MetaQuantsFactory.sol#L53

Tool used

Manual Review

Recommendation

use MessageHashUtils-toEthSignedMessageHash