I'm using the OpenZeppelin's EIP712 implementation for a project where users can make an offchain signature of a certain structure to give a contract the permission to do something with their token (previously they must have made an approve obviously).

The structure and the signature are then publicly disclosed so other people can call the contract which then is allowed to perform these operations with the users that gave it the permission with the offchain signature.

My concern is this: I just added a completely free field in this structure (a timestamp, useful to distinguish beetween these structures) that is completely ignored by the contract, it never reads nor uses it in its logic. In some way could someone manipulate this (irrelevant for the contract) value to get a (valid) signature for some address?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.