mirror of
https://github.com/luxfi/precompile.git
synced 2026-09-24 00:26:21 +00:00
zeekay
96ba923c2f
The registrar digest bound only the selector and the arguments, so a signature set authorising "register chain 5" stayed valid forever: anyone who saw the original transaction could re-apply it after an unregister, or re-apply a superseded SetGateway. The digest now carries a governance nonce that advances after each successful write. Selector 0x06 reads it. The nonce lives outside the govSlot namespace so re-seeding cannot revive retired authorisations. Two more, both reachable without any signature being valid. Every submitted signature is ECRECOVERed before any of them is known to belong to an operator, and the flat write fee bought up to 255 of them; signatures are now billed at the EVM's own ECRECOVER price. And loadGovernance allocated from a count it read out of storage, which genesis alloc can pre-populate at any address, so a malformed genesis could ask for four billion addresses at boot.