The home for Hyperlane core contracts, sdk packages, and other infrastructure

blockchainhyperlaneinterchainmonorepo

You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Kunal Arora 2760da1ded fix: ensure no duplicate signatures verified for `AbstractWeightedMultisigIsm.verify()` (#4468) ... ### Description - There's a bug in the verify function of `AbstractWeightedMultisigIsm` that an attacker might use to bypass the verification of multiple signatures. The code tried to check the duplication of the signers if not found, but the code does not increment validatorIndex when the recovered signer matches to the stored signer. For instance: - validatorsAndThresholdWeight returns [A, B, C, D] - an attacker uses signatures as [sig from A, sig from A, sig from A, sig from A, ...] or [sig from B, sig from B, …] Fix is to add a ++validatorIndex at the end of the for loop implies we don't allow the next signer to be the same as the signer we just verified. ### Drive-by changes None ### Related issues From Chainlight's audit findings ### Backward compatibility We haven't deployed these contracts yet on testnet/mainnet ### Testing Fuzz testing		1 month ago
..
layer-zero	LayerZero Hook and ISM (#3102)	9 months ago
AggregationIsm.t.sol	Multisig and Aggregation ISM Metadata Encoding (#3701)	7 months ago
ArbL2ToL1Ism.t.sol	chore: refactor MessagIdHook/ISM tests into a common `ExternalBridgeTest` contract (#4490)	2 months ago
DomainRoutingIsm.t.sol	Refactor key management in infra and key funder (#3023)	12 months ago
ERC5164ISM.t.sol	fix: add fix for checking for correct messageId in `OPL2ToL1Ism` and `ArbL2ToL1Ism` via external call (#4437)	1 month ago
ExternalBridgeTest.sol	fix: add fix for checking for correct messageId in `OPL2ToL1Ism` and `ArbL2ToL1Ism` via external call (#4437)	1 month ago
IsmTestUtils.sol	Graduate to yarn 4 🧶 (#2899)	1 year ago
MultisigIsm.t.sol	fix: ensure no duplicate signatures verified for `AbstractWeightedMultisigIsm.verify()` (#4468)	1 month ago
OPL2ToL1Ism.t.sol	chore: refactor MessagIdHook/ISM tests into a common `ExternalBridgeTest` contract (#4490)	2 months ago
OPStackIsm.t.sol	fix: add fix for checking for correct messageId in `OPL2ToL1Ism` and `ArbL2ToL1Ism` via external call (#4437)	1 month ago
PausableIsm.t.sol	Pausable ISM (#3141)	11 months ago
PolygonPosIsm.t.sol	add polygon hook and ism (#3038)	7 months ago
RateLimitedIsm.t.sol	fix: recipient rate limited ISM (#4636)	2 months ago
TrustedRelayerIsm.t.sol	Implement trusted relayer ISM (#3363)	8 months ago
WeightedMultisigIsm.t.sol	fix: ensure no duplicate signatures verified for `AbstractWeightedMultisigIsm.verify()` (#4468)	1 month ago