Skip to content

v0.16.1

Choose a tag to compare

View all tags
@ryanio ryanio released this 10 Jun 22:27
· 23 commits to main since this release
v0.16.1
88c7927

What's Changed

  • Security fix: validBefore is now required in predicate-gate authorizations. Previously a caller could sign a TransferWithAuthorization with validBefore=0 and omit the field from the X-Payment payload, so the expiry check was skipped and the gate accepted an unbounded, non-expiring proof. The field is now required in both the X-Payment and EIP-3009 auth paths, with the now-dead validBefore !== undefined guards and the ?? "0" recovery fallback removed.

Community Contributions

  • Reported and fixed by @Nexory (#9, #10). Thanks for the detailed writeup and the matching PR.

Full Changelog: ProjectOpenSea/opensea-devtools@tool-sdk-v0.16.0...tool-sdk-v0.16.1

Contributors

Nexory
Assets 2
Loading