search

AmbireTech / adex-protocol-eth

Ethereum implementation of the Ambire Protocol: Ambire Wallet contracts and AdEx payment channels
https://www.ambire.com
MIT License
51 stars 24 forks source link

Security: chainId as part of signatures #174

Closed Ivshti closed 7 months ago

Ivshti commented 2 years ago

Problem

Currently, we do not hash the chainId as part of the signable hash for the balance tree. As a result, if we have the same OUTPACE address and channel ID (hash) across two chains, replay attacks are possible

Solution

Hash the chainId together with hashToSign OR as part of the channelId, whichever is cheaper

Timeline

This has to be solved BEFORE we deploy Ambire AdEx to two separate chains

Ivshti commented 7 months ago

solved, will be added