QA Report

[code423n4]

QA report

Low Risk

[L-01] The recoverKey function don't out of it's bound

In SignatureDecoder.sol, recoverKey function if call this function with a high pos, this overflow the messageSignatures, this would contain bytes (0) or maybe dirty bytes

Check if the position does not overflow the array:

function recoverKey(
    bytes32 messageHash,
    bytes memory messageSignatures,
    uint256 pos
) internal pure returns (address) {
    uint256 messageSignaturesLength = messageSignatures.length;
    if (messageSignaturesLength % 65 != 0) {
        return (address(0));
    }
    if (pos < messageSignaturesLength / 65) {
        return (address(0));
    }

    uint8 v;
    bytes32 r;
    bytes32 s;
    (v, r, s) = signatureSplit(messageSignatures, pos);

    // If the version is correct return the signer address
    if (v != 27 && v != 28) {
        return (address(0));
    } else {
        // solium-disable-next-line arg-overflow
        return ecrecover(toEthSignedMessageHash(messageHash), v, r, s);
    }
}