Skip to content

Conversation

alvrs
Copy link
Member

@alvrs alvrs commented Jan 23, 2025

closes #3437

Copy link

changeset-bot bot commented Jan 23, 2025

⚠️ No Changeset found

Latest commit: 80137a4

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@@ -0,0 +1,174 @@
// SPDX-License-Identifier: MIT
// OpenZeppelin Contracts (last updated v5.0.0) (utils/cryptography/ECDSA.sol)
Copy link
Member

@frolic frolic Jan 23, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

did we decide it was better to copy/paste these here instead of importing from OZ as a dep?

if we keep this here, maybe should put these in a vendor or similar directory to better isolate unchanged and already audited copy/pasted source files?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think the original reason was that the OZ package was a pretty heavy dependency and we only needed very few files from it. At this point we do have a couple vendored OZ files in the world package (ERC165Checker, IERC1967, Proxy, StorageSlot) but I don't think it's worth changing our approach now. MUD is audited as a whole and the auditors can easily check that the files match the original sources. Changing paths of a Solidity package is always annoying because it would break things downstream if the files are imported since there are no explicit exports/remappings.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I hope no one has imported these directly 🙈 wonder if we should start putting not-for-external-use source files into internal dirs, like we've started doing for TS exports

@alvrs alvrs force-pushed the call-with-signature branch from 6d20d2a to 80137a4 Compare March 17, 2025 22:07
@alvrs alvrs marked this pull request as ready for review March 17, 2025 22:13
@alvrs alvrs merged commit 5955a0c into audit-2 Mar 17, 2025
4 of 15 checks passed
@alvrs alvrs deleted the call-with-signature branch March 17, 2025 22:13
@alvrs alvrs restored the call-with-signature branch March 17, 2025 22:15
@alvrs
Copy link
Member Author

alvrs commented Mar 17, 2025

combining all changes that require an audit into #3630

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

needs audit This code needs to be audited

Projects

None yet

Development

Successfully merging this pull request may close these issues.

audit CallWithSignature module

2 participants