Submitted by Aamir, also found by shaka, 0xCiphky, osmanozdemir1, SovaSlava, bart1e, and rvierdiiev
Encoding of encodedData is not done correctly for the verification of EIP712 signed messages.
CultureIndex::_verifyVoteSignature() is called by other functions like CultureIndex::voteForManyWithSig() and CultureIndex::batchVoteForManyWithSig() for the verification of the signed messages in order to cast vote. But the encoding of hashStruct is not done correctly in the function.
hashStruct is combination of two things. typeHash and encodedData. Read more here.
If any one of them is constructed in a wrong way then the verification will not work.
In CultureIndex::_verifyVoteSignature(), typeHash is calculated like this which is correct:
But encodedData is not right. According to EIP712, the encoding of array should be done like this before hashing the struct data:
Read More here
But in CultureIndex::_verifyVoteSignature(), simply pieceIds is passed to keccak256 to calculate the struct hash. This will result in the improper functioning of the function and will not let anybody to cast vote.
All of the link mentioned above. Also Read this Ethereum exchange conversation.
Use keccak256 hash of the pieceIds before constructing the struct hash.
rocketman-21 (Revolution) confirmed
For this audit, 34 reports were submitted by wardens detailing low risk and non-critical issues. The report highlighted below by 0xmystery received the top score from the judge.
The following wardens also submitted reports: sivanesh_808, peanuts, hals, bart1e, Pechenite, Ward, IllIllI, cheatc0d3, spacelord47, MrPotatoMagic, shaka, Aamir, developerjordy, deth, 0xhitman, kaveyjoe, BARW, imare, King_, ast3ros, ZanyBonzy, 00xSEV, 0xDING99YA, 0xCiphky, roland, osmanozdemir1, ktg, Topmark, leegh, ABAIKUNANBAEV, SovaSlava, SpicyMeatball, and rvierdiiev.
