OpenZeppelin / OpenZeppelin/openzeppelin-contracts
SignatureChecker should check for contract method first.
Nobody has claimed this yet.
- Dominant language
- Solidity
- Stars
- 27.2k
- Forks
- 12.4k
- Avg merge
- 2d 19h
- Merged PRs (30d)
- 33
Description
The SignatureChecker.isValidSignatureNow() performs 2 separate checks:
- if the account is an EOA, attempt to perform
ecrecover() - if the account is a contract, call the
isValidSignatureon that contract.
Currently, it performs them in the above order.
While currently it is quite fine, this ordering is not "future-proof": If at any point in the future we would allow an EOA to be upgraded to a contract (e.g. via EIP-7377 ) , the old signed messages (created before it was migrated) will still be valid.
A better way to implement the SignatureChecker is first try to treat it as a contract, and only if it fails, try ecrecover and assume this is an EOA.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at the SignatureChecker.isValidSignatureNow() entry point and trace its current EOA ecrecover and contract isValidSignature checks. Change the ordering so contract validation is attempted first and ecrecover is used only if that fails; done means this future-proof behavior is implemented and verified by relevant tests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- solidity
- Domain
- blockchain, security
- Issue type
- Refactor
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 35/100