GitBulletin

Repository: farcasterxyz/hub-monorepo

Digital Identity Security Strengthened as FID Validation Enhancements Roll Out!

2024-10-24 18:25:16 UTC

Latest update seals loophole that allowed users to wrongly claim ENS names, ensuring rightful ownership in the virtual realm.

Commit Details:

fix: validate that fid on username add message matches fid on ens proof (#2378) This fixes a bug which allows an users to assume an arbitrary user's ens name as their own. ## Merge Checklist _Choose all relevant options below by adding an `x` now or at any time before submitting for review_ - [x] PR title adheres to the [conventional commits](https://www.conventionalcommits.org/en/v1.0.0/) standard - [x] PR has a [changeset](https://github.com/farcasterxyz/hub-monorepo/blob/main/CONTRIBUTING.md#35-adding-changesets) - [x] PR has been tagged with a change label(s) (i.e. documentation, feature, bugfix, or chore) - [ ] PR includes [documentation](https://github.com/farcasterxyz/hub-monorepo/blob/main/CONTRIBUTING.md#32-writing-docs) if necessary. <!-- start pr-codex --> --- ## PR-Codex overview This PR focuses on enhancing the validation of `fid` in user data messages to ensure that it matches the `fid` associated with the username proof, specifically for `fname` and `ENS` types. ### Detailed summary - Updated validation logic in `index.ts` to check if `fid` matches for `fname` and `ENS` username types. - Added error handling for invalid username types. - Introduced a new test case in `index.test.ts` to verify failure when `fid` on message does not match `fid` on ENS name proof. > ✨ Ask PR-Codex anything about this PR by commenting with `/codex {your question}` <!-- end pr-codex -->

Search Similar