Skip to content

[ H4ck3r-netizen ] [ Crypto ] Fix MultiSigWallet confirmation race condition during execution callback#2

Open
H4ck3r-netizen wants to merge 571 commits into
mainfrom
h4ck3r/fix-multisig-race-916
Open

[ H4ck3r-netizen ] [ Crypto ] Fix MultiSigWallet confirmation race condition during execution callback#2
H4ck3r-netizen wants to merge 571 commits into
mainfrom
h4ck3r/fix-multisig-race-916

Conversation

@H4ck3r-netizen

Copy link
Copy Markdown
Owner

github-actions Bot and others added 30 commits May 25, 2026 10:30
- Add block.chainid to signed message hash via EIP-712 domain separator
  to prevent cross-chain replay attacks
- Add per-sender nonce mapping (replacing global nonce) to prevent
  same-chain replay attacks
- Include contract address in EIP-712 domain separator to prevent
  replay after proxy upgrades
- Add explicit zero-address check on ecrecover return value
- Implement full EIP-712 typed data signing with domain separator
  (name, version, chainId, verifyingContract)
- Add getNonce(address) view function for querying per-sender nonces
- Add zero-address validation in constructor for _bridgeToken and _validator

Fixes UnsafeLabs#920
- Add reentrancy guard (nonReentrant modifier) to executeTransaction
- Add confirmation snapshot tracking to detect revocations during callback
- Add blockConfirmations mapping for block-level confirmation queries
- Add isConfirmedAtBlock() and getConfirmationCountAtBlock() functions
- Add zero-address validation on 'to' in submitTransaction
- Add code-size awareness for contract targets
- Add zero-address validation for owners in constructor
- Post-execution verification that confirmations weren't revoked

Closes UnsafeLabs#916
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[ Crypto ] Fix MultiSigWallet confirmation race condition during execution callback

1 participant