Submitted by yixxas, also found by CloudX and ladboy233
The underlying assumption of eoaRepresentative being an EOA can be untrue. This can cause many unintended effects as the contract comments strongly suggests that this must be an EOA account.
When BLS public key is registered in registerBLSPublicKeys(), it has the check of
However, this check can be passed even though input is a smart contract if
It is generally not recommended to enforce an address to be only EOA and AFAIK, this is impossible to enforce due to the aforementioned cases. I recommend the protocol team to take a closer look at this and build the protocol with the assumption that _eoaRepresentative == EOA.
vince0656 (Stakehouse) disputed and commented:
LSDan (judge) commented:
