Security context

Highlights

Auth Bypass: 1 prior fix. Scrutinize any change in this area.

contracts/contracts/Umbra.sol: most-fixed (2 issues). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

Signature Replay: The contract was vulnerable to signature replay attacks across different deployed contract instances on the same chain because the signature domain separation relied on a static version string instead of the deployment contract address. This could allow an attacker to replay a valid withdrawal signature on another deployment of the protocol.

Auth Bypass: Lack of strict token address binding within the meta-transaction withdrawal signature digest allowed authorization bypass via cross-token signature reuse, letting an attacker reuse a signature intended for one token to withdraw another.

Unicode Homograph Attack: Custom unicode validation failed to prevent homograph spoofing attacks, requiring standard ENS normalization to reliably validate addresses and prevent phishing or destination address spoofing.