search

mysteriumnetwork / payments-smart-contracts

Smart contracts for payments flow
GNU General Public License v3.0
30 stars 15 forks source link

Change Hermes URL replay #127

Closed vkuznecovas closed 2 years ago

vkuznecovas commented 3 years ago

Hermes URL change does not accept chain ID. Meaning I can update hermes URL on one chain and as long as their addresses and owners are the same I can replay the request.

chompomonim commented 2 years ago

URL is suppose to be same on both chains so we don't need protection here. Running same request on same change is not possible because we do have nonce in signature on updateHermesURL call.