iden3 / contracts / 36708163386

85%

push

github

Use abi.encode for multiRequestId hash (#464)

multiRequestId was keccak256(abi.encodePacked(requestIds, groupIds, sender)).
With two dynamic uint256[] arrays the packed encoding is ambiguous, so
e.g. ([1,2],[3]) and ([1],[2,3]) produced the same id (slither
encode-packed-collision). Switch to abi.encode.

Breaking for multiRequest creators: ids computed with the old formula
now revert with MultiRequestIdNotValid. Existing multiRequests are
unaffected, since the id is only checked in setMultiRequest.

- UniversalVerifier VERSION 3.0.0 -> 3.1.0
- Tests use the local calculateMultiRequestId helper instead of js-sdk's
- Add tests for legacy id rejection and split collision

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

1 of 1 new or added line in 1 file covered. (100.0%)

3430 of 4015 relevant lines covered (85.43%)

0.85 hits per line