Suppose we have a verifying contract that relays to arbitrary contracts. The appropriate signature and parameter types of the given contract method is known before signing.
The signing method being used is eth_signTypedData_v3 via MetaMask.
Would you be able to send the method signature along with its parameter data for verification?
I ask because I see most signatures hardcoded in verifying contracts and want to make sure this isn't a security vulnerability. Below is the meat of what I'm talking about
//Client
const msgParams = JSON.stringify({types:
{
EIP712Domain:[
{name:"name",type:"string"},
{name:"version",type:"string"},
{name:"chainId",type:"uint256"},
{name:"verifyingContract",type:"address"}
],
Outlet:[
{name:"signature",type:"string"}
{name:"sender",type:"address"},
{name:"_nonce",type:"uint256"},
{name:"deadline", type:"uint256"}
]
},
//make sure to replace verifyingContract with address of deployed contract
primaryType:"Outlet",
domain:{name:"SetTest",version:"1",chainId:342,verifyingContract:0x482959AIFIJF...},
message:{
signature:"play(address sender, uint256 _nonce, uint256 deadline, uint8 choice)",
sender: 0x252AD....,
_nonce: 31,
deadline: Date.now() + 10000;
}
})
Then on the verifying contract (hashStruct part).
function executeSetIfSignatureMatch(
uint8 v,
bytes32 r,
bytes32 s,
string signature,
address sender,
uint256 _nonce,
uint256 deadline
) external {
require(block.timestamp < deadline, "Signed transaction expired");
uint256 chainId = 342;
bytes32 eip712DomainHash = keccak256(
abi.encode(
keccak256(
"EIP712Domain(string name,string version,uint256 chainId,address verifyingContract)"
),
keccak256(bytes("SetTest")),
keccak256(bytes("1")),
chainId,
address(this)
)
);
bytes32 hashStruct = keccak256(
abi.encode(
keccak256(signature),
sender,
_nonce,
deadline
)
);
bytes32 hash = keccak256(abi.encodePacked("\x19\x01", eip712DomainHash, hashStruct));
address signer = ecrecover(hash, v, r, s);
require(signer == sender, "MyFunction: invalid signature");
require(signer != address(0), "ECDSA: invalid signature");