The home for Hyperlane core contracts, sdk packages, and other infrastructure

blockchainhyperlaneinterchainmonorepo

You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Kunal Arora 2760da1ded fix: ensure no duplicate signatures verified for `AbstractWeightedMultisigIsm.verify()` (#4468) ... ### Description - There's a bug in the verify function of `AbstractWeightedMultisigIsm` that an attacker might use to bypass the verification of multiple signatures. The code tried to check the duplication of the signers if not found, but the code does not increment validatorIndex when the recovered signer matches to the stored signer. For instance: - validatorsAndThresholdWeight returns [A, B, C, D] - an attacker uses signatures as [sig from A, sig from A, sig from A, sig from A, ...] or [sig from B, sig from B, …] Fix is to add a ++validatorIndex at the end of the for loop implies we don't allow the next signer to be the same as the signer we just verified. ### Drive-by changes None ### Related issues From Chainlight's audit findings ### Backward compatibility We haven't deployed these contracts yet on testnet/mainnet ### Testing Fuzz testing		1 month ago
..
AbstractMerkleRootMultisigIsm.sol	feat: add `IStaticWeightedIsm` implementation (#4170)	4 months ago
AbstractMessageIdMultisigIsm.sol	feat: add `IStaticWeightedIsm` implementation (#4170)	4 months ago
AbstractMultisigIsm.sol	feat: embed package version in deployed bytecode (#4518)	2 months ago
AbstractWeightedMultisigIsm.sol	fix: ensure no duplicate signatures verified for `AbstractWeightedMultisigIsm.verify()` (#4468)	1 month ago
StaticMultisigIsm.sol	feat: add `IStaticWeightedIsm` implementation (#4170)	4 months ago
ValidatorAnnounce.sol	Graduate to yarn 4 🧶 (#2899)	1 year ago
WeightedMultisigIsm.sol	feat: add sdk support for `IStaticWeightedMultisigIsm` (#4331)	3 months ago