Skip to content

Conversation

@maradini77
Copy link

Summary

Fixes a bug in SemVerMixin._majorVersion() that was returning only the first byte of the version string (e.g., 'v' from "v1.2.3") instead of the complete major version component (e.g., "1"). This caused the EIP-712 domain separator to remain unchanged across major version upgrades, violating signature isolation between incompatible releases.

Problem

The previous implementation of _majorVersion() returned only the first character:

return string(abi.encodePacked(v[0])); // Returns 'v' or first digit

This meant:

  • "v1.2.3" and "v2.0.0" would both contribute the same value ('v') to the domain separator
  • EIP-712 signatures from older major versions remained valid after contract upgrades
  • The intended security property of signature invalidation on major version changes was not enforced

Solution

Updated _majorVersion() to:

  1. Skip optional 'v'/'V' prefix
  2. Extract all characters until the first '.'
  3. Return the complete major version component as a string

This ensures the domain separator changes correctly when the major version is incremented, properly isolating signatures across incompatible releases.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant