Modular pay gateway + audit fixes #8
Conversation
src/PaymentsGatewayExtension.sol
Outdated
| keccak256("PayoutInfo(bytes32 clientId,address payoutAddress,uint256 feeAmount)"); | ||
| bytes32 private constant REQUEST_TYPEHASH = | ||
| keccak256( | ||
| "PayRequest(bytes32 clientId,bytes32 transactionId,address tokenAddress,uint256 tokenAmount,uint256 expirationTimestamp,PayoutInfo[] payouts,address forwardAddress,bytes data)PayoutInfo(bytes32 clientId,address payoutAddress,uint256 feeAmount)" |
There was a problem hiding this comment.
This might be a typo. I believe it should be just
PayRequest(bytes32 clientId,bytes32 transactionId,address tokenAddress,uint256 tokenAmount,uint256 expirationTimestamp,PayoutInfo[] payouts,address forwardAddress,bytes data)
There was a problem hiding this comment.
Yeah this looks confusing, but we need nested structs to be represented this way in typehash.
EIP712 requires nested struct types to be sorted and appended to the encoding.
src/PaymentsGatewayExtension.sol
Outdated
| ) | ||
| ); | ||
|
|
||
| bytes32 digest = _hashTypedData(structHash); |
There was a problem hiding this comment.
For gas saving purposes, we should probably implement the following function from solady EIP-712.
https://github.com/Vectorized/solady/blob/43f9d49815c8126d92771b26bd9bdbe2dbea87a5/src/utils/EIP712.sol#L95
Since this is a module, the domain separator will be initially signed with the module address in the constructor, but since this will be called via delegateCall the addresses won't match since it will be using the core contracts address
Solady's implementation cover's for this, but it's cheaper gas wise if we make it explicit:
https://github.com/Vectorized/solady/blob/43f9d49815c8126d92771b26bd9bdbe2dbea87a5/src/utils/EIP712.sol#L130
kumaryash90
force-pushed
the
yash/modular-pay-gateway
branch
from
04792c0 to
d78ad75
Compare
No description provided.