Merge pull request #22 from 5afe/feat/stay-in-calldata

Feature: Stay in calldata for validation, remove the need for an external library

contracts/P256Signer.sol

@@ -1,6 +1,6 @@
 pragma solidity ^0.8.0;
 
-import {WrapperFCLWebAuthn} from "./FCL/WrapperFCLWebAuthn.sol";
+import {FCL_WebAuthn} from "FreshCryptoLib/FCL_Webauthn.sol";
 
 /// @title P256Signer
 /// @notice A contract used to verify ECDSA signatures over secp256r1 through
@@ -40,7 +40,7 @@ contract P256Signer {
     /// @param _hash The hash of the data signed
     /// @param _signature The signature
     /// @return The EIP-1271 magic value
-    function isValidSignature(bytes32 _hash, bytes memory _signature) public view returns (bytes4) {
+    function isValidSignature(bytes32 _hash, bytes calldata _signature) public view returns (bytes4) {
         _validate(abi.encode(_hash), _signature);
         return EIP1271_MAGICVALUE;
     }
@@ -51,20 +51,41 @@ contract P256Signer {
     /// @param _hash The hash of the data signed
     /// @param _signature The signature
     /// @return The EIP-1271 magic value
-    function isValidSignature(bytes memory _hash, bytes memory _signature) public view returns (bytes4) {
+    function isValidSignature(bytes memory _hash, bytes calldata _signature) public view returns (bytes4) {
         _validate(_hash, _signature);
         return OLD_EIP1271_MAGICVALUE;
     }
 
+    struct SignatureLayout {
+        bytes authenticatorData;
+        bytes clientData;
+        uint256 challengeOffset;
+        uint256[2] rs;
+    }
+
     /// @notice Validates the signature
     /// @param data The data signed
     /// @param _signature The signature
-    function _validate(bytes memory data, bytes memory _signature) private view {
+    function _validate(bytes memory data, bytes calldata _signature) private view {
         bytes32 _hash = keccak256(data);
-        (bytes memory authenticatorData, bytes memory clientData, uint256 challengeOffset, uint256[2] memory rs) =
-            abi.decode(_signature, (bytes, bytes, uint256, uint256[2]));
-
-        bool valid = WrapperFCLWebAuthn.checkSignature(authenticatorData, 0x01, clientData, _hash, challengeOffset, rs, [x, y]);
+        SignatureLayout calldata signaturePointer;
+        // This code should precalculate the offsets of variables as defined in the layout
+        // Calldata variables are represented as offsets, and, I think, length for dynamic types
+        // If the calldata is malformed (e.g., shorter than expected), this will revert with an out of bounds error
+        assembly {
+            signaturePointer := _signature.offset
+        }
+
+        bool valid = FCL_WebAuthn.checkSignature(
+            signaturePointer.authenticatorData,
+            0x01,
+            signaturePointer.clientData,
+            _hash,
+            signaturePointer.challengeOffset,
+            signaturePointer.rs,
+            x,
+            y
+        );
 
         if (!valid) revert InvalidSignature();
     }

test/foundry/P256Signer.t.sol

@@ -18,7 +18,6 @@ contract TestP256Signer is Test {
     bytes signature =
         hex"00000000000000000000000000000000000000000000000000000000000000a000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000024f96f45dc5dd16534b2bcc45b87b71b3cfd413a6bcb288e643895bd3477203d74a11c98f8421c52839fff32d61140e793d353a47319bfe0dfd2af18af1d8f016b000000000000000000000000000000000000000000000000000000000000002549960de5880e8c687434170f6476605b8fe4aeb9a28632c7995cf3ba831d9763050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000867b2274797065223a22776562617574686e2e676574222c226368616c6c656e6765223a22704a76594669576e4174537138646c72426f6a7243724135454a7846417852757071504b39737077744430222c226f726967696e223a22687474703a2f2f6c6f63616c686f73743a33303030222c2263726f73734f726967696e223a66616c73657d0000000000000000000000000000000000000000000000000000";
     bytes messageToSign = hex"cdf841e2c26037e4331174c05ee3e822c5cb6c076b70101637af03284c56e29e";
-
     function setUp() public {
         signer = new P256Signer();
         factory = new P256SignerFactory(address(signer));
@@ -47,7 +46,7 @@ contract TestP256Signer is Test {
     // Once done, test that a revert with InvalidSignature() is expected
     function testFuzzRevertInvalidSignatureOld(bytes memory signature_) public {
         bytes memory messageToSignMem = messageToSign;
-        vm.expectRevert(bytes(""));
+        vm.expectRevert();
         signerInstance.isValidSignature(messageToSignMem, signature_);
     }