hyperlane-monorepo

The home for Hyperlane core contracts, sdk packages, and other infrastructure

blockchain hyperlane interchain monorepo

History

Kunal Arora 2760da1ded fix: ensure no duplicate signatures verified for `AbstractWeightedMultisigIsm.verify()` (#4468 ) ### Description - There's a bug in the verify function of `AbstractWeightedMultisigIsm` that an attacker might use to bypass the verification of multiple signatures. The code tried to check the duplication of the signers if not found, but the code does not increment validatorIndex when the recovered signer matches to the stored signer. For instance: - validatorsAndThresholdWeight returns [A, B, C, D] - an attacker uses signatures as [sig from A, sig from A, sig from A, sig from A, ...] or [sig from B, sig from B, …] Fix is to add a ++validatorIndex at the end of the for loop implies we don't allow the next signer to be the same as the signer we just verified. ### Drive-by changes None ### Related issues From Chainlight's audit findings ### Backward compatibility We haven't deployed these contracts yet on testnet/mainnet ### Testing Fuzz testing		1 month ago
..
aggregation	feat: embed package version in deployed bytecode (#4518 )	2 months ago
ccip-read	Add code spellcheck CI job (#3467 )	8 months ago
hook	fix: add fix for checking for correct messageId in `OPL2ToL1Ism` and `ArbL2ToL1Ism` via external call (#4437 )	1 month ago
libs	feat: add `IStaticWeightedIsm` implementation (#4170 )	4 months ago
multisig	fix: ensure no duplicate signatures verified for `AbstractWeightedMultisigIsm.verify()` (#4468 )	1 month ago
routing	feat: embed package version in deployed bytecode (#4518 )	2 months ago
warp-route	fix: recipient rate limited ISM (#4636 )	2 months ago
NoopIsm.sol	feat: embed package version in deployed bytecode (#4518 )	2 months ago
PausableIsm.sol	feat: embed package version in deployed bytecode (#4518 )	2 months ago
TrustedRelayerIsm.sol	feat: embed package version in deployed bytecode (#4518 )	2 months ago