2 Commits (ec6b874b15fcdee8ddbd189fb714866f2c5df6be)

Author	SHA1	Message	Date
Kunal Arora	2760da1ded	fix: ensure no duplicate signatures verified for `AbstractWeightedMultisigIsm.verify()` (#4468) ... ### Description - There's a bug in the verify function of `AbstractWeightedMultisigIsm` that an attacker might use to bypass the verification of multiple signatures. The code tried to check the duplication of the signers if not found, but the code does not increment validatorIndex when the recovered signer matches to the stored signer. For instance: - validatorsAndThresholdWeight returns [A, B, C, D] - an attacker uses signatures as [sig from A, sig from A, sig from A, sig from A, ...] or [sig from B, sig from B, …] Fix is to add a ++validatorIndex at the end of the for loop implies we don't allow the next signer to be the same as the signer we just verified. ### Drive-by changes None ### Related issues From Chainlight's audit findings ### Backward compatibility We haven't deployed these contracts yet on testnet/mainnet ### Testing Fuzz testing	1 month ago
Kunal Arora	d396e2c553	feat: add `IStaticWeightedIsm` implementation (#4170) ... ### Description - Adding the static variation of the IWeightedIsm config where you configure validators with their corresponding weights and store it as bytecode. ### Drive-by changes None ### Related issues - fixes https://github.com/hyperlane-xyz/hyperlane-monorepo/issues/4160 ### Backward compatibility Yes ### Testing Fuzz tests	4 months ago