Skip to content

fix: 7683 depositor exclusivity deadline#1310

Closed
grasphoper wants to merge 2 commits intomasterfrom
fix-7683-timestamp
Closed

fix: 7683 depositor exclusivity deadline#1310
grasphoper wants to merge 2 commits intomasterfrom
fix-7683-timestamp

Conversation

@grasphoper
Copy link
Copy Markdown
Collaborator

@grasphoper grasphoper commented Feb 11, 2026

Fixes inconsistency between orderId derivation in the ERC7683OrderDepositor and in the SpokePool.

Problem:

SpokePool uses exclusivityDeadline to hash relayData (so the absolute value of the deadline in seconds), while ERC7683OrderDepositor used a thing more akin to an exclusivityParameter, which can be absolute value in seconds, or can be relative to the current timestamp. This param is being converted by the SpokePool into the absolute deadline at the time of deposit

Fix:

  • create RelayDataHashLib that defines logic to convert the exclusivity param to absolute timestamp
  • use that logic in the depositor to come up with correct orderId
  • still pass in a raw exclusivity param from depositor into the spoke to prevent double-normalization problems (where f(f(x)) != f(x) where x is exclusivity param). While unlikely to be a problem in realistic scenarious, I think this is a nice touch

Signed-off-by: Ihor Farion <ihor@umaproject.org>
Comment thread contracts/erc7683/ERC7683OrderDepositor.sol Outdated
Signed-off-by: Ihor Farion <ihor@umaproject.org>
Comment thread contracts/SpokePool.sol
V3SpokePoolInterface.V3RelayData memory relayData = abi.decode(originData, (V3SpokePoolInterface.V3RelayData));
if (RelayDataHashLib.getRelayDataHash(relayData, chainId()) != orderId) {
revert WrongERC7683OrderId();
}
Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Don't love this since this involves abi.encoding relayData back into bytes just to get the hash

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yeah I think we need to do this though unless we also pass in relayData as a function param?

@grasphoper grasphoper marked this pull request as ready for review February 11, 2026 07:01
@grasphoper grasphoper added the need to audit This PR needs to be audited externally before deploying label Feb 11, 2026
@grasphoper grasphoper changed the title fix: timestamp inconsistency fix: 7683 depositor exclusivity deadline Feb 11, 2026
@grasphoper
Copy link
Copy Markdown
Collaborator Author

Closing this as we decided removing code would be more preferable. Will recreate later

@grasphoper grasphoper closed this Feb 25, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

need to audit This PR needs to be audited externally before deploying

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants