Digital Identity Security Strengthened as FID Validation Enhancements Roll Out!
Latest update seals loophole that allowed users to wrongly claim ENS names, ensuring rightful ownership in the virtual realm.
Commit Details:
fix: validate that fid on username add message matches fid on ens proof (#2378) This fixes a bug which allows an users to assume an arbitrary user's ens name as their own. ## Merge Checklist _Choose all relevant options below by adding an `x` now or at any time before submitting for review_ - [x] PR title adheres to the [conventional commits](https://www.conventionalcommits.org/en/v1.0.0/) standard - [x] PR has a [changeset](https://github.com/farcasterxyz/hub-monorepo/blob/main/CONTRIBUTING.md#35-adding-changesets) - [x] PR has been tagged with a change label(s) (i.e. documentation, feature, bugfix, or chore) - [ ] PR includes [documentation](https://github.com/farcasterxyz/hub-monorepo/blob/main/CONTRIBUTING.md#32-writing-docs) if necessary. <!-- start pr-codex --> --- ## PR-Codex overview This PR focuses on enhancing the validation of `fid` in user data messages to ensure that it matches the `fid` associated with the username proof, specifically for `fname` and `ENS` types. ### Detailed summary - Updated validation logic in `index.ts` to check if `fid` matches for `fname` and `ENS` username types. - Added error handling for invalid username types. - Introduced a new test case in `index.test.ts` to verify failure when `fid` on message does not match `fid` on ENS name proof. > ✨ Ask PR-Codex anything about this PR by commenting with `/codex {your question}` <!-- end pr-codex -->