From 20fdff18aecb1dcd9a2f419cb72482f5ba0348d0 Mon Sep 17 00:00:00 2001 From: hazim-j Date: Sun, 3 Aug 2025 17:36:30 +1000 Subject: [PATCH 1/3] Findings 17: add comment to address intentional missing short-circuit --- src/verifier/UserOpWebAuthnCosignVerifier.sol | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/verifier/UserOpWebAuthnCosignVerifier.sol b/src/verifier/UserOpWebAuthnCosignVerifier.sol index 6f57c33..5a5fbbf 100644 --- a/src/verifier/UserOpWebAuthnCosignVerifier.sol +++ b/src/verifier/UserOpWebAuthnCosignVerifier.sol @@ -39,9 +39,11 @@ contract UserOpWebAuthnCosignVerifier is IVerifier, OnlyKeystore { (address cosigner, bytes32 x, bytes32 y) = abi.decode(config, (address, bytes32, bytes32)); WebAuthn.WebAuthnAuth memory auth = WebAuthn.tryDecodeAuth(webauthnData); + + // Note: always run verification for both signatures in order maintain consistent gas usage + // during simulation with dummy signers. bool cosignValid = cosigner == ECDSA.recover(message, ecdsaSignature); bool webauthnValid = WebAuthn.verify(abi.encode(message), true, auth, x, y); - return (cosignValid && webauthnValid) ? SIG_VALIDATION_SUCCESS : SIG_VALIDATION_FAILED; } } From 9beaf1443627f381fd0bf685d7f0641cdc796885 Mon Sep 17 00:00:00 2001 From: hazim-j Date: Sun, 3 Aug 2025 17:38:30 +1000 Subject: [PATCH 2/3] better comment --- src/verifier/UserOpWebAuthnCosignVerifier.sol | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/verifier/UserOpWebAuthnCosignVerifier.sol b/src/verifier/UserOpWebAuthnCosignVerifier.sol index 5a5fbbf..518c15a 100644 --- a/src/verifier/UserOpWebAuthnCosignVerifier.sol +++ b/src/verifier/UserOpWebAuthnCosignVerifier.sol @@ -40,7 +40,7 @@ contract UserOpWebAuthnCosignVerifier is IVerifier, OnlyKeystore { (address cosigner, bytes32 x, bytes32 y) = abi.decode(config, (address, bytes32, bytes32)); WebAuthn.WebAuthnAuth memory auth = WebAuthn.tryDecodeAuth(webauthnData); - // Note: always run verification for both signatures in order maintain consistent gas usage + // Note: always run verification for both signatures in order calculate accurate gas estimates // during simulation with dummy signers. bool cosignValid = cosigner == ECDSA.recover(message, ecdsaSignature); bool webauthnValid = WebAuthn.verify(abi.encode(message), true, auth, x, y); From c49e9c5ba2308869737d785ffe747386ae38735e Mon Sep 17 00:00:00 2001 From: hazim-j Date: Sun, 3 Aug 2025 17:40:38 +1000 Subject: [PATCH 3/3] better comment --- src/verifier/UserOpWebAuthnCosignVerifier.sol | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/verifier/UserOpWebAuthnCosignVerifier.sol b/src/verifier/UserOpWebAuthnCosignVerifier.sol index 518c15a..b27a84f 100644 --- a/src/verifier/UserOpWebAuthnCosignVerifier.sol +++ b/src/verifier/UserOpWebAuthnCosignVerifier.sol @@ -40,8 +40,8 @@ contract UserOpWebAuthnCosignVerifier is IVerifier, OnlyKeystore { (address cosigner, bytes32 x, bytes32 y) = abi.decode(config, (address, bytes32, bytes32)); WebAuthn.WebAuthnAuth memory auth = WebAuthn.tryDecodeAuth(webauthnData); - // Note: always run verification for both signatures in order calculate accurate gas estimates - // during simulation with dummy signers. + // Note: always run verification for both signatures in order to calculate accurate gas + // estimates during simulation with dummy signers. bool cosignValid = cosigner == ECDSA.recover(message, ecdsaSignature); bool webauthnValid = WebAuthn.verify(abi.encode(message), true, auth, x, y); return (cosignValid && webauthnValid) ? SIG_VALIDATION_SUCCESS : SIG_VALIDATION_FAILED;