Skip to content

Conversation

@alexcos20
Copy link
Member

Fixes # .

Changes proposed in this PR:

@alexcos20 alexcos20 requested a review from trentmc as a code owner January 28, 2026 12:10
Comment on lines +128 to +156
function _recoverSigner(bytes32 hash, bytes memory signature) internal pure returns (address) {
require(signature.length == 65, "GrantsTokenFaucet: invalid signature length");

bytes32 r;
bytes32 s;
uint8 v;

assembly {
r := mload(add(signature, 32))
s := mload(add(signature, 64))
v := and(mload(add(signature, 65)), 255)
}

// Prevent signature malleability: s must be in the lower half of the secp256k1 curve order
require(uint256(s) <= 0x7FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF5D576E7357A4501DDFE92F46681B20A0,
"GrantsTokenFaucet: invalid signature s value");

// Handle v values 0-1 (EIP-155) and 27-28 (legacy)
if (v < 27) {
v += 27;
}

require(v == 27 || v == 28, "GrantsTokenFaucet: invalid signature v value");

address recovered = ecrecover(hash, v, r, s);
require(recovered != address(0), "GrantsTokenFaucet: invalid signature recovery");

return recovered;
}

Check warning

Code scanning / Slither

Assembly usage Warning

@openzeppelin-code
Copy link

add faucet for grants token

Generated at commit: d2e7d37bf92ec99d0d6a883fcd251e57a4d03520

🚨 Report Summary

Severity Level Results
Contracts Critical
High
Medium
Low
Note
Total
2
1
0
9
40
52
Dependencies Critical
High
Medium
Low
Note
Total
0
0
0
0
0
0

For more details view the full report in OpenZeppelin Code Inspector

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants