Skip to content

Commit 9227bf0

Browse files
razwwclaude
andcommitted
fix(audit): restore Uniswap text in NFTSVG provenance signature
Bailsec Issue_05 (Informational). The natspec block in generateSVG() carries a signed-provenance message originally produced by the upstream Uniswap author (0xe8ab...c163). The signature is bound to the literal bytes of the signed message; switching the message text from "Uniswap" to "Lista" while retaining the same signature broke the chain — the sig no longer proves anything about the displayed statement. Reverts the message back to "Uniswap" so the retained signature stays honest about who signed what. The block is a Solidity comment only and has no runtime effect. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
1 parent 16c644c commit 9227bf0

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

src/periphery/libraries/NFTSVG.sol

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ library NFTSVG {
4646
function generateSVG(SVGParams memory params) internal pure returns (string memory svg) {
4747
/*
4848
address: "0xe8ab59d3bcde16a29912de83a90eb39628cfc163",
49-
msg: "Forged in SVG for Lista in 2021 by 0xe8ab59d3bcde16a29912de83a90eb39628cfc163",
49+
msg: "Forged in SVG for Uniswap in 2021 by 0xe8ab59d3bcde16a29912de83a90eb39628cfc163",
5050
sig: "0x2df0e99d9cbfec33a705d83f75666d98b22dea7c1af412c584f7d626d83f02875993df740dc87563b9c73378f8462426da572d7989de88079a382ad96c57b68d1b",
5151
version: "2"
5252
*/

0 commit comments

Comments
 (0)