`GasSponsoredInvoker` is critically vulnerable

[paradigmxyz]

`GasSponsoredInvoker` is critically vulnerable

[fgimenez]

@fgimenez started a PR demonstrating the fix, I just haven't figured out how to re-build the Solidity in this repo yet (i tweaked the function signature and need the updated abi to make the sol! macro work)

yep, you can rebuild the artifacts with make build-eip3074-bytecode, I'll open a PR to include this in the README

[fgimenez]

@anna-carroll thanks for raising this! you are right, the contracts here are used only in the integration tests, not meant to be deployed. in any case ideas to fix the issue are very welcome :)

[anna-carroll]

@fgimenez started a PR demonstrating the fix, I just haven't figured out how to re-build the Solidity in this repo yet (i tweaked the function signature and need the updated abi to make the sol! macro work)

[anna-carroll]

alternative uglier solution would be to leave the function signature the same & add

        require(commit == keccak256(abi.encode(to, data), "Invalid commit");

but nevertheless, would like to build & run tests to validate the fix 😅