Skip to content

Audit/9-4 #241

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ameeshaagrawal merged 3 commits into from
Dec 24, 2025
Merged

Audit/9-4 #241

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
e9b29d1
fix: add nonce to sign
ameeshaagrawal Dec 22, 2025
ffed58e
fix: rearrange nonce
ameeshaagrawal Dec 23, 2025
e5b7a63
Merge branch 'phase-1' into audit/9-4
ameeshaagrawal Dec 23, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 7 additions & 1 deletion contracts/protocol/switchboard/EVMxSwitchboard.sol
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -266,7 +266,13 @@ contract EVMxSwitchboard is SwitchboardBase {

address watcher = _recoverSigner(
keccak256(
abi.encodePacked(toBytes32Format(address(this)), chainSlug, oldDigest, newDigest)
abi.encodePacked(
toBytes32Format(address(this)),
chainSlug,
oldDigest,
newDigest,
nonce_
)
),
signature_
);
Expand Down
8 changes: 7 additions & 1 deletion contracts/protocol/switchboard/MessageSwitchboard.sol
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -697,7 +697,13 @@ contract MessageSwitchboard is SwitchboardBase, ReentrancyGuard {

address watcher = _recoverSigner(
keccak256(
abi.encodePacked(toBytes32Format(address(this)), chainSlug, oldDigest, newDigest)
abi.encodePacked(
toBytes32Format(address(this)),
chainSlug,
oldDigest,
newDigest,
nonce_
)
),
signature_
);
Expand Down
43 changes: 34 additions & 9 deletions test/protocol/switchboard/EVMxSwitchboard.t.sol
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -284,18 +284,25 @@ contract EVMxSwitchboardTestBase is Test, Utils {
*/
function _createAssignTransmitterSignature(
DigestParams memory digestParams_,
address newTransmitter_
address newTransmitter_,
uint256 nonce_
) internal view returns (bytes memory signature) {
// Create old digest with current transmitter (before modification)
bytes32 oldDigest = createDigest(digestParams_);

// Create new digest with new transmitter
digestParams_.transmitter = toBytes32Format(newTransmitter_);
bytes32 newDigest = createDigest(digestParams_);

// Create signature digest with both old and new digests
bytes32 signatureDigest = keccak256(
abi.encodePacked(toBytes32Format(address(evmxSwitchboard)), CHAIN_SLUG, oldDigest, newDigest)
abi.encodePacked(
toBytes32Format(address(evmxSwitchboard)),
CHAIN_SLUG,
oldDigest,
newDigest,
nonce_
)
);
signature = createSignature(signatureDigest, watcherPrivateKey);
}
Expand Down Expand Up @@ -1179,7 +1186,11 @@ contract SocketPayloadIdVerificationTest is EVMxSwitchboardTestBase {
assertEq(oldDigest, storedDigest, "Old digest should match stored digest");

// Create signature for new transmitter
bytes memory signature = _createAssignTransmitterSignature(digestParams, newTransmitter);
bytes memory signature = _createAssignTransmitterSignature(
digestParams,
newTransmitter,
nonce
);

// Create new digest for verification
digestParams.transmitter = toBytes32Format(newTransmitter);
Expand Down Expand Up @@ -1229,7 +1240,11 @@ contract SocketPayloadIdVerificationTest is EVMxSwitchboardTestBase {
);

// Create signature for new transmitter
bytes memory signature = _createAssignTransmitterSignature(digestParams, newTransmitter);
bytes memory signature = _createAssignTransmitterSignature(
digestParams,
newTransmitter,
nonce
);

// Should revert because old digest doesn't match stored digest
vm.prank(getWatcherAddress());
Expand Down Expand Up @@ -1271,14 +1286,19 @@ contract SocketPayloadIdVerificationTest is EVMxSwitchboardTestBase {

// Create old digest with old transmitter
bytes32 oldDigest = createDigest(digestParams);

// Create new digest with new transmitter
digestParams.transmitter = toBytes32Format(newTransmitter);
bytes32 newDigest = createDigest(digestParams);

// Create signature digest with both old and new digests with non-watcher key
bytes32 signatureDigest = keccak256(
abi.encodePacked(toBytes32Format(address(evmxSwitchboard)), CHAIN_SLUG, oldDigest, newDigest)
abi.encodePacked(
toBytes32Format(address(evmxSwitchboard)),
CHAIN_SLUG,
oldDigest,
newDigest
)
);
bytes memory signature = createSignature(signatureDigest, nonWatcherKey);

Expand Down Expand Up @@ -1320,7 +1340,11 @@ contract SocketPayloadIdVerificationTest is EVMxSwitchboardTestBase {
);

// Create signature for new transmitter
bytes memory signature = _createAssignTransmitterSignature(digestParams, newTransmitter);
bytes memory signature = _createAssignTransmitterSignature(
digestParams,
newTransmitter,
nonce
);

// First call succeeds
vm.prank(getWatcherAddress());
Expand Down Expand Up @@ -1349,7 +1373,8 @@ contract SocketPayloadIdVerificationTest is EVMxSwitchboardTestBase {
// Create signature for the new assignment
bytes memory signature2 = _createAssignTransmitterSignature(
updatedDigestParams,
anotherNewTransmitter
anotherNewTransmitter,
nonce
);

vm.prank(getWatcherAddress());
Expand Down
27 changes: 21 additions & 6 deletions test/protocol/switchboard/MessageSwitchboard.t.sol
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -517,7 +517,8 @@ contract MessageSwitchboardTest is Test, Utils {
*/
function _createAssignTransmitterSignature(
DigestParams memory digestParams_,
address newTransmitter_
address newTransmitter_,
uint256 nonce_
) internal view returns (bytes memory signature) {
// Create old digest with current transmitter (before modification)
bytes32 oldDigest = createDigest(digestParams_);
Expand All @@ -532,7 +533,8 @@ contract MessageSwitchboardTest is Test, Utils {
toBytes32Format(address(messageSwitchboard)),
SRC_CHAIN,
oldDigest,
newDigest
newDigest,
nonce_
)
);
signature = createSignature(signatureDigest, watcherPrivateKey);
Expand Down Expand Up @@ -2446,7 +2448,11 @@ contract MessageSwitchboardTest is Test, Utils {
assertEq(oldDigest, storedDigest, "Old digest should match stored digest");

// Create signature for new transmitter
bytes memory signature = _createAssignTransmitterSignature(digestParams, newTransmitter);
bytes memory signature = _createAssignTransmitterSignature(
digestParams,
newTransmitter,
nonce
);

// Create new digest for verification
digestParams.transmitter = toBytes32Format(newTransmitter);
Expand Down Expand Up @@ -2496,7 +2502,11 @@ contract MessageSwitchboardTest is Test, Utils {
);

// Create signature for new transmitter
bytes memory signature = _createAssignTransmitterSignature(digestParams, newTransmitter);
bytes memory signature = _createAssignTransmitterSignature(
digestParams,
newTransmitter,
nonce
);

// Should revert because old digest doesn't match stored digest
vm.prank(getWatcherAddress());
Expand Down Expand Up @@ -2592,7 +2602,11 @@ contract MessageSwitchboardTest is Test, Utils {
);

// Create signature for new transmitter
bytes memory signature = _createAssignTransmitterSignature(digestParams, newTransmitter);
bytes memory signature = _createAssignTransmitterSignature(
digestParams,
newTransmitter,
nonce
);

// First call succeeds
vm.prank(getWatcherAddress());
Expand Down Expand Up @@ -2621,7 +2635,8 @@ contract MessageSwitchboardTest is Test, Utils {
// Create signature for the new assignment
bytes memory signature2 = _createAssignTransmitterSignature(
updatedDigestParams,
anotherNewTransmitter
anotherNewTransmitter,
nonce
);

vm.prank(getWatcherAddress());
Expand Down