code-423n4 / 2024-02-renft-mitigation-findings

0 stars 0 forks source link

m-13 MitigationConfirmed #19

Open c4-bot-9 opened 6 months ago

c4-bot-9 commented 6 months ago

Lines of code

Vulnerability details

C4 Issue

M-13: RentPayload's signature can be replayed

Comments

Rent payload signatures could be used to replay rent creation.

Mitigation

PR-10: Prevents RentPayload replayability and ensures order uniqueness

The protocol now compares the signature payload with the SeaPort payload when creating a rental
- They should match or the transaction will revert
The Seaport order uses a counter that works as a nonce.
- This way the protocol can make sure that all signatures are different and they can't be replayed anymore
Tests were added to verify that replaying signatures is not possible anymore

Conclusions

Successful Mitigation

c4-judge commented 6 months ago

gzeon-c4 marked the issue as satisfactory

c4-judge commented 6 months ago

gzeon-c4 marked the issue as confirmed for report