Skip to content

fix: compute AgentToken domain separator dynamically for replay protection#5140

Open
KHHH2312 wants to merge 2 commits into
ClankerNation:mainfrom
KHHH2312:fix/issue-162-permit-chainid
Open

fix: compute AgentToken domain separator dynamically for replay protection#5140
KHHH2312 wants to merge 2 commits into
ClankerNation:mainfrom
KHHH2312:fix/issue-162-permit-chainid

Conversation

@KHHH2312
Copy link
Copy Markdown

/claim #162
💳 Payment: USDC | 0x43991A9dC8Ddf492eab6E55685644c2cb9B001D2 | Base

Changes

  • Replaced immutable DOMAIN_SEPARATOR with dynamically evaluated block.chainid.
  • Implemented private _computeDomainSeparator() and caching pattern.
  • Implemented DOMAIN_SEPARATOR() view function.
  • Included the mandated Initialization Text comment block.
  • Added explicit EIP-712 dynamic separator tests in AgentTokenDomainSeparator.test.js.

Copilot AI review requested due to automatic review settings May 31, 2026 14:47
Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds chain-ID-aware EIP-712 domain separator recomputation to AgentToken to protect against replay attacks following a chain fork, along with tests and Solidity compiler config updates.

Changes:

  • Replace immutable DOMAIN_SEPARATOR storage with a view function that recomputes the separator when block.chainid differs from the deployment chain id.
  • Update permit to call the new DOMAIN_SEPARATOR() function.
  • Add tests for dynamic domain separator and permit; bump Solidity to 0.8.24 with cancun/viaIR settings.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 5 comments.

File Description
contracts/token/AgentToken.sol Refactors domain separator into a chain-ID-aware view function; also adds an extraneous header comment block.
test/AgentTokenDomainSeparator.test.js Adds tests for dynamic domain separator and permit flow.
hardhat.config.js Switches to compilers array, bumps to 0.8.24, enables viaIR and cancun EVM.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment on lines +68 to +69
function DOMAIN_SEPARATOR() public view returns (bytes32) {
return block.chainid == _initialChainId ? _initialDomainSeparator : _computeDomainSeparator(_hashedName, _hashedVersion);
Comment thread test/AgentTokenDomainSeparator.test.js Outdated
Comment on lines +43 to +44
it("should successfully execute a permit using the dynamic domain separator", async function () {
const [owner, spender] = await ethers.getSigners();
Comment on lines +11 to +14
beforeEach(async function () {
[owner] = await ethers.getSigners();

const AgentToken = await ethers.getContractFactory("AgentToken");
Comment thread test/AgentTokenDomainSeparator.test.js Outdated
Comment on lines +8 to +9
const initialChainId = 31337; // Hardhat default
const newChainId = 12345;
Comment thread hardhat.config.js
Comment on lines +7 to +9
version: "0.8.24",
settings: {
evmVersion: "cancun",
- Added eip712Domain() function to comply with EIP-5267.
- Cleaned up shadowed variables and unused code in tests.
@KHHH2312
Copy link
Copy Markdown
Author

I have pushed an update addressing Copilot's review feedback:

  1. Test Cleanup: Removed the unused variables, the shadowed owner variable, and the dead after hook in AgentTokenDomainSeparator.test.js.
  2. ABI Compatibility: Added the eip712Domain() function (EIP-5267) to AgentToken.sol to explicitly expose the domain parameters for downstream tooling, preserving compatibility.
  3. EVM Version: Kept evmVersion: "cancun" because OpenZeppelin ^5.1.0 utilizes the MCOPY opcode natively in Bytes.sol. Compiling with paris or shanghai throws a compilation error (DeclarationError: Function mcopy not found). Since Base network successfully activated the Cancun/Dencun hardfork, deploying with the cancun target is required and safe.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants