Status DataClose notification

Kinetic Disclosed Report

Audit Report

Wrong `DOMAIN_TYPEHASH` definition

Target

https://github.com/kinetic-market/public-money-market-contracts

Vulnerability details

The incorrect DOMAIN_TYPEHASH definition breaks the EIP712 standard.

Validation steps

In the build of the DOMAIN TYPEHASH the string version is forgotten. https://github.com/kinetic-market/public-money-market-contracts/blob/main/contracts/Governance/ProtocolTokenStorage.sol#L22

    bytes32 public constant DOMAIN_TYPEHASH = keccak256("EIP712Domain(string name,uint256 chainId,address verifyingContract)");


Acording the EIP 712, in the Definition of domainSeparator:

  • "string version the current major version of the signing domain. Signatures from different versions are not compatible"

It is recommenced to add string version, to the EIP712Domain string

bytes32 public constant DOMAIN_TYPEHASH = keccak256("EIP712Domain(string name,string version,uint256 chainId,address verifyingContract)");

Comments are hidden

This information is not publicly available.