safe-global / safe-modules / 8783507331

100%

master: 85%

push

github

Verify WebAuthn Signature Encoding (#388)

This PR adds logic to verify the WebAuthn signature encoding length.
This is done so that encodings have a strict upper bound (determined by
the 'standard' ABI encoding of the `WebAuthn.Signature` struct) on the
length of the signatures.

This prevents a potential griefing attack where the signature that is
sent to an ERC-4337 bundler could be arbitrarily padded with additional
`0`s (which would have trivial increases to the `calldatasize` with
onchain LZMA calldata decompression that already exists) while causing
accounts to pay significantly more in gas costs for signature
verification (bounded by the `verificationGasLimit`).

---------

Co-authored-by: Mikhail <16622558+mmv08@users.noreply.github.com>

20 of 20 branches covered (100.0%)

Branch coverage included in aggregate %.

39 of 39 relevant lines covered (100.0%)

27.54 hits per line