Description
In src/stellar/signatures.ts:17 and src/stellar/signatures.ts:61, both createQuizProof and createMintAuthorization include timestamp: Date.now() in the payload. This means:
- Every call produces a different hash for the same arguments
verifyQuizProof cannot reconstruct the original hash because it doesn't know the timestamp
Impact
Proofs are non-reproducible for verification. The verify function can only confirm "platform signed this hash" but not "this hash matches these specific arguments."
Files
src/stellar/signatures.ts:17 (createQuizProof)
src/stellar/signatures.ts:61 (createMintAuthorization)
Suggested Fix
Remove the timestamp from the signed payload, or make it a deterministic parameter passed to both create and verify functions.
Description
In
src/stellar/signatures.ts:17andsrc/stellar/signatures.ts:61, bothcreateQuizProofandcreateMintAuthorizationincludetimestamp: Date.now()in the payload. This means:verifyQuizProofcannot reconstruct the original hash because it doesn't know the timestampImpact
Proofs are non-reproducible for verification. The verify function can only confirm "platform signed this hash" but not "this hash matches these specific arguments."
Files
src/stellar/signatures.ts:17(createQuizProof)src/stellar/signatures.ts:61(createMintAuthorization)Suggested Fix
Remove the timestamp from the signed payload, or make it a deterministic parameter passed to both create and verify functions.