Skip to content

[MEDIUM] Proofs include Date.now(), making them non-reproducible #33

Description

@DeFiVC

Description

In src/stellar/signatures.ts:17 and src/stellar/signatures.ts:61, both createQuizProof and createMintAuthorization include timestamp: Date.now() in the payload. This means:

  • Every call produces a different hash for the same arguments
  • verifyQuizProof cannot reconstruct the original hash because it doesn't know the timestamp

Impact

Proofs are non-reproducible for verification. The verify function can only confirm "platform signed this hash" but not "this hash matches these specific arguments."

Files

src/stellar/signatures.ts:17 (createQuizProof)
src/stellar/signatures.ts:61 (createMintAuthorization)

Suggested Fix

Remove the timestamp from the signed payload, or make it a deterministic parameter passed to both create and verify functions.

Metadata

Metadata

Assignees

No one assigned

    Labels

    GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardOfficial CampaignCampaign: Official CampaignbugSomething isn't workingmedium

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions