Make chain ID available to contracts #2226
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Contracts are given access to the ID of the chain being operated. This will allow contracts to check if a call was made originally on this chain, - by mixing the chain ID into a signature for example - effectively allowing them to prevent replay of calls performed on other chains.
ureeves
requested review from
miloszm,
fed-franz,
HDauven,
moCello,
herr-seppia,
Neotamandua and
fullstackjade
ureeves
added
fix:vulnerability
|
Never mind, I misinterpreted your PR message. LGTM |
HDauven
previously approved these changes
Aug 30, 2024
Adding the chain ID to both transaction models and to relevant calls allows contracts downstream to check if they are being executed on the intended chain. The cost is minimal - 1 byte in the payload - and the benefits are cross-chain replay attack protection.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
At the moment, contracts have no way to check which chain they're operating in. As a consequence, cross-chain replay attacks are made possible. In this PR we expose the chain ID to contracts and make use of it in our own transactions and calls where appropriate.
The changes effectively make it impossible to replay transactions on different chains, as well as allow contract developers to do the same with their own call data structures.