Empty signature allowed for owner as caller

ethcatherders · Nov 7, 2024 · 15cef63 · 15cef63
1 parent fe32126
commit 15cef63
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 3 deletions.
diff --git a/src/EIPAuthorReward.sol b/src/EIPAuthorReward.sol
@@ -209,9 +209,11 @@ contract EIPAuthorReward is
         if (_claimed[author][claimable.id]) {
             revert AlreadyClaimed(author, claimable.id);
         }
-        bytes32 hash = _hashClaimableStruct(claimable);
-        if (!_isValidSignature(owner(), hash, signature)) {
-            revert InvalidSignature();
+        if (owner() != msg.sender) {
+            bytes32 hash = _hashClaimableStruct(claimable);
+            if (!_isValidSignature(owner(), hash, signature)) {
+                revert InvalidSignature();
+            }
         }
         _claimed[author][claimable.id] = true;
         _supply++;

diff --git a/test/unit/EIPAuthorReward.t.sol b/test/unit/EIPAuthorReward.t.sol
@@ -62,6 +62,15 @@ contract EIPAuthorRewardTest is BaseTest {
         assertEq(reward.balanceOf(sender, id), 1);
     }
 
+    function test_claim_asOwner() public {
+        address recipient = vm.addr(3);
+
+        vm.prank(owner);
+        reward.claim(EIPAuthorReward.Claimable({id: 1, author: "author", to: recipient}), "");
+
+        assertEq(reward.balanceOf(recipient, 1), 1);
+    }
+
     function test_claimed() public {
         _signAndExecuteClaim(
             reward,