Skip to content

sapience-2 #417

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
kingofclubstroyDev wants to merge 2 commits into
base: master
Choose a base branch
from
Open

sapience-2 #417

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0570b13
sapience-2
kingofclubstroyDev Apr 2, 2026
06db706
fix
kingofclubstroyDev Apr 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
48 changes: 48 additions & 0 deletions client/library/library/audits/sapience-2.html
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,48 @@
<page
clientName="Sapience"
reportDate="April 2, 2026"
auditTitle="Sapience A-2"
auditVersion="1.0.0"
repoUrl="https://github.com/sapiencexyz/sapience"
repoCommitHash="cfbaaa8045706ed96a604cb4484b55f11809553b"
finalCommitHash="162a139e60cbdcb52761865a45723e7fe3ae5db1"
customRepoInfo
layout="/library/audits/_layout.html"
>

<content-for name="schedule">
The security audit was performed by the Macro security team from March 26 to March 29, 2026.
</content-for>

<content-for name="spec">
<ul>
<li>Discussions on Discord with the {{page.clientName}} team.</li>
<li>Technical documentation available in the repository.</li>
</ul>
</content-for>


<content-for name="repo-info">
<ul>
<li>
<b>Repository:</b>
<a href="{{page.repoUrl}}" target="_blank">
{{page.repoUrl.split('/').slice(-1)[0]}}
</a>
</li>
<li class="break-words break-all">
Commit Hash <b>(initial)</b>:
<code>cfbaaa8045706ed96a604cb4484b55f11809553b</code>
</li>
</ul>
</content-for>


<content-for name="source-code">

<p>We audited the following contracts with <b>f2b6bd9231ae9915f9ba88f6bef02e7a914e6288</b> commit hash:</p>
<template type="file-hashes">
1bec137aef2a1f962c40ae22f12e754e4cb958cf131a3e4db024662569acbcc9 packages/protocol/src/SecondaryMarketEscrow.sol
25b8666dc38cba5f9c6f5077e31c07aa07f76a12ae11fa8291f421238f56ff25 packages/protocol/src/interfaces/ISecondaryMarketEscrow.sol
</template>
</content-for>
38 changes: 38 additions & 0 deletions content/collections/public/sapience-2-issues.html
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,38 @@
<item>
<field name="topic">Verification</field>
<field name="impact">medium</field>
<field name="chance">low</field>
<field name="status">fixed</field>
<field name="commit">TODO</field>
<field name="content">
## [L-1] Add ability to view `tradeHash` to verify parameters being signed

Users can view their trade approval hash via [`getTradeApprovalHash()`](https://github.com/sapiencexyz/sapience/blob/cfbaaa8045706ed96a604cb4484b55f11809553b/packages/protocol/src/SecondaryMarketEscrow.sol#L185-L198) to verify the data hash being to be signed by the user. This requires inputting a `tradeHash` which contains a hash of important trade data including the token and collateral types, amount and price. Allowing users to be able to input this data and generate the trade hash used in the trade approval hash would help verify what they are actually signing, since a malicious hash could result in negative outcomes for the user.

**Remediations to Consider**

Add the ability to generate the trade hash with its input parameters to more easily verify what exactly is being signed.
</field>
</item>

<item>
<field name="topic">Duplicate code</field>
<field name="impact">low</field>
<field name="status">fixed</field>
<field name="commit">TODO</field>
<field name="content">
## [Q-1] Duplicate code used to generate `TradeApprovalHash`

--- | --- |
| **Impact** | low |

The trade approval hash which is signed and verified in trades is generated in the public view function [`getTradeApprovalHash()`](https://github.com/sapiencexyz/sapience/blob/cfbaaa8045706ed96a604cb4484b55f11809553b/packages/protocol/src/SecondaryMarketEscrow.sol#L185-L198), as well as independently in both [`_isTradeApprovalValid()`](https://github.com/sapiencexyz/sapience/blob/cfbaaa8045706ed96a604cb4484b55f11809553b/packages/protocol/src/SecondaryMarketEscrow.sol#L262-L282) and [`_isTradeApprovalValidWithEIP1271Fallback()`](https://github.com/sapiencexyz/sapience/blob/cfbaaa8045706ed96a604cb4484b55f11809553b/packages/protocol/src/SecondaryMarketEscrow.sol#L284-L315). Although the result is the same valid hash, and no branch calculates it multiple times, it is best practice to reduce duplicate code where possible to prevent issues creeping up if changes are made in the future.

**Remediations to Consider**

Use [`getTradeApprovalHash()`](https://github.com/sapiencexyz/sapience/blob/cfbaaa8045706ed96a604cb4484b55f11809553b/packages/protocol/src/SecondaryMarketEscrow.sol#L185-L198) wherever the approval hash is required to prevent duplicate code.

---
</field>
</item>