Skip to content

Reject non-integer EIP-7702 chainId and nonce - #428

Open
SashaMIT wants to merge 1 commit into
MetaMask:mainfrom
SashaMIT:codered-eip7702-integer
Open

SashaMIT wants to merge 1 commit into
MetaMask:mainfrom
SashaMIT:codered-eip7702-integer

Conversation

@SashaMIT

Copy link
Copy Markdown

Summary

validateEIP7702Authorization treated any number below 2 ** 256 as a chain id, and any number below 2 ** 64 as a nonce. NaN fails both comparisons, so it passed. hashEIP7702Authorization([NaN, address, 0]) returned db86e3cd1a31bc187733ee8b8a707715572ba541f4774be4f7cbba44ab45d453. A NaN nonce hashed the same as nonce 0.

Number.isInteger now rejects NaN and fractional values. Integer chain ids and nonces still sign and recover.

Test plan

  • should throw if chainId is NaN and should throw if nonce is NaN did not throw on main
  • npx jest src/sign-eip7702-authorization.test.ts (38 tests OK)

Made with Cursor

NaN passed the number check and still hashed. Number.isInteger rejects it before the authorization is signed or recovered.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant