Skip to content

Comments

feat(HypercoreDepositHandler): Allow different types of messages passed to handleAcrossV3Message#1223

Merged
grasphoper merged 2 commits intoaudit-jan19from
deposit-handler-hybrid
Jan 15, 2026
Merged

feat(HypercoreDepositHandler): Allow different types of messages passed to handleAcrossV3Message#1223
grasphoper merged 2 commits intoaudit-jan19from
deposit-handler-hybrid

Conversation

@nicholaspai
Copy link
Member

Read first byte to determine how to decode message:

  • type 1: message = abi.encode(user)
  • type 2: message = abi.encode(user, signature)

type 2 messages can be used to activate new accounts, type 1 cannot

@nicholaspai nicholaspai added the need to audit This PR needs to be audited externally before deploying label Jan 5, 2026
@nicholaspai nicholaspai marked this pull request as ready for review January 5, 2026 18:56
@grasphoper
Copy link
Contributor

@nicholaspai are we moving forward with sig-based account creation? As we discussed in Slack, this doesn't fully protect us from griefing, but makes griefing a bit harder

@nicholaspai
Copy link
Member Author

@nicholaspai are we moving forward with sig-based account creation? As we discussed in Slack, this doesn't fully protect us from griefing, but makes griefing a bit harder

Yes, because we want the griefing protection to be possible at the API level. With signatures we can control do this, whereas if we don't have signatures at all, then even the API can't protect against this.

@grasphoper
Copy link
Contributor

@nicholaspai are we moving forward with sig-based account creation? As we discussed in Slack, this doesn't fully protect us from griefing, but makes griefing a bit harder

Yes, because we want the griefing protection to be possible at the API level. With signatures we can control do this, whereas if we don't have signatures at all, then even the API can't protect against this.

Oh, you mean that the API can block by IP and such?

@grasphoper grasphoper changed the base branch from master to audit-jan19 January 15, 2026 17:07
nicholaspai and others added 2 commits January 15, 2026 13:26
…ed to handleAcrossV3Message

Read first byte to determine how to decode `message`:
- type 1: message = abi.encode(user)
- type 2: message = abi.encode(user, signature)

type 2 messages can be used to activate new accounts, type 1 cannot
Co-authored-by: Faisal Usmani <faisal.of.usmani@gmail.com>
@grasphoper grasphoper force-pushed the deposit-handler-hybrid branch from 71a96d6 to d55797b Compare January 15, 2026 21:26
@grasphoper grasphoper merged commit 94a306a into audit-jan19 Jan 15, 2026
10 of 11 checks passed
@grasphoper grasphoper deleted the deposit-handler-hybrid branch January 15, 2026 23:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

need to audit This PR needs to be audited externally before deploying

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants