Hot answers tagged

2

In general there is no issue in using ecrecover the most important part is how you create the hash that you sign (e.g. include the contract address and chain id into the hash to prevent replay attacks) Most wallets don't let you sign data that could potentially be a raw transaction. Therefore you have a couple standards for signing. The most notable ones are ...


2

I'm assuming that both the contracts are created using this template based on the code you posted. Let's say contract A is deployed at ADDRESS_A. We'll need to add an interface to interact with contract A. interface IToken { function balanceOf(address) external view returns (uint256); } Now in our _mint function, we can check if the msg.sender has ...


1

There is a clear front-running issue with the claimTokens function. Let's say that user A sends a claimTokens transaction with a signed message as the sig parameter. User B (evil) sees the transaction in the mempool. To claim the tokens that belong to A, all B has to do is copy the parameters of A's transaction, including sig, and send its own claimTokens ...


Only top voted, non community-wiki answers of a minimum length are eligible