MaslarovK - 'hashProposal' function will lead to wrong hash due to a wrong `questionId` type in the abi.encode

[sherlock-admin2]

MaslarovK

Medium

'hashProposal' function will lead to wrong hash due to a wrong questionId type in the abi.encode

Summary

In the hashProposal function, the questionId is set to be uint256, but in the Proposal struct it is set as bytes32.

Root Cause

No response

Internal pre-conditions

No response

External pre-conditions

No response

Attack Path

No response

Impact

This will lead to wrong hash being generated dues to uint256 being interpret in a different way compared to bytes32.

PoC

No response

Mitigation

Change the hashProposal function as follows:

function hashProposal(Proposal calldata proposal) public view returns (bytes32 digest) {
        digest = _hashTypedDataV4(
            keccak256(
                abi.encode(
                    keccak256(
                        "Proposal(address from,uint256 loanAmount,uint256 collateralAmount,uint8 questionType,bytes32 questionId,bool outcome,uint256 interestRatePerSecond,uint256 duration,uint256 validUntil,uint256 salt,uint256 nonce,uint8 proposalType,uint256 protocolFeeBasisPoints)"
                    ),
                    proposal.from,
                    proposal.loanAmount,
                    proposal.collateralAmount,
                    proposal.questionType,
                    proposal.questionId,
                    proposal.outcome,
                    proposal.interestRatePerSecond,
                    proposal.duration,
                    proposal.validUntil,
                    proposal.salt,
                    proposal.nonce,
                    proposal.proposalType,
                    proposal.protocolFeeBasisPoints
                )
            )
        );
    }

[sherlock-admin2]

The protocol team fixed this issue in the following PRs/commits: https://github.com/PredictDotFun/predict-dot-loan/pull/37