T1MOH - encodeData is incorrectly calculated thus not compatible with EIP712

[sherlock-admin3]

T1MOH

medium

encodeData is incorrectly calculated thus not compatible with EIP712

Summary

According to EIP712:

The dynamic values bytes and string are encoded as a keccak256 hash of their contents.

However in TitlesGraph.sol it is just encoded without hashing

Vulnerability Detail

Here you can see that bytes data is not properly encoded:

    modifier checkSignature(bytes32 edgeId, bytes calldata data, bytes calldata signature) {
@>      bytes32 digest = _hashTypedData(keccak256(abi.encode(ACK_TYPEHASH, edgeId, data)));
        if (
            !edges[edgeId].to.creator.target.isValidSignatureNowCalldata(digest, signature)
                || _isUsed[keccak256(signature)]
        ) {
            revert Unauthorized();
        }
        _;
        _isUsed[keccak256(signature)] = true;
    }

Impact

Contract is not compatible with EIP712

Code Snippet

https://github.com/sherlock-audit/2024-04-titles/blob/main/wallflower-contract-v2/src/graph/TitlesGraph.sol#L41

Tool used

Manual Review

Recommendation

-       bytes32 digest = _hashTypedData(keccak256(abi.encode(ACK_TYPEHASH, edgeId, data)));
+       bytes32 digest = _hashTypedData(keccak256(abi.encode(ACK_TYPEHASH, edgeId, keccak256(data))));

Duplicate of #74