Skip to content

Conversation

@nicholaspai
Copy link
Member

Read first byte to determine how to decode message:

  • type 1: message = abi.encode(user)
  • type 2: message = abi.encode(user, signature)

type 2 messages can be used to activate new accounts, type 1 cannot

…ed to handleAcrossV3Message

Read first byte to determine how to decode `message`:
- type 1: message = abi.encode(user)
- type 2: message = abi.encode(user, signature)

type 2 messages can be used to activate new accounts, type 1 cannot
@nicholaspai nicholaspai added the need to audit This PR needs to be audited externally before deploying label Jan 5, 2026
@nicholaspai nicholaspai marked this pull request as ready for review January 5, 2026 18:56
@grasphoper
Copy link
Contributor

@nicholaspai are we moving forward with sig-based account creation? As we discussed in Slack, this doesn't fully protect us from griefing, but makes griefing a bit harder

@nicholaspai
Copy link
Member Author

@nicholaspai are we moving forward with sig-based account creation? As we discussed in Slack, this doesn't fully protect us from griefing, but makes griefing a bit harder

Yes, because we want the griefing protection to be possible at the API level. With signatures we can control do this, whereas if we don't have signatures at all, then even the API can't protect against this.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

need to audit This PR needs to be audited externally before deploying

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants