2025 10 21 audit

.gas-snapshot

@@ -1,10 +1,10 @@
-LibDescribedByMetaEmitForDescribedAddressTest:testEmitForDescribedAddressHappy(bytes) (runs: 5099, μ: 262353, ~: 262297)
-LibDescribedByMetaEmitForDescribedAddressTest:testEmitForDescribedAddressMismatch(bytes,bytes) (runs: 5099, μ: 264255, ~: 264233)
-LibMetaCheckMetaHashedV1_2Test:testCheckMetaHashedV1_2BadMagicBadHash(bytes,bytes32) (runs: 5099, μ: 5634, ~: 5616)
-LibMetaCheckMetaHashedV1_2Test:testCheckMetaHashedV1_2BadMagicGoodHash(bytes) (runs: 5099, μ: 5719, ~: 5694)
-LibMetaCheckMetaHashedV1_2Test:testCheckMetaHashedV1_2GoodMagicBadHash(bytes,bytes32) (runs: 5099, μ: 5783, ~: 5771)
-LibMetaCheckMetaHashedV1_2Test:testCheckMetaHashedV1_2Happy(bytes) (runs: 5099, μ: 1103, ~: 1095)
-LibMetaCheckMetaUnhashedV1_2Test:testCheckMetaUnhashedV1_2Fuzz(bytes) (runs: 5099, μ: 5818, ~: 5797)
-LibMetaIsRainMetaV1_2Test:testIsRainMetaV1_2Fuzz(bytes) (runs: 5099, μ: 4167, ~: 4162)
-MetaBoardHashTest:testMetaboardHash(bytes) (runs: 5099, μ: 199676, ~: 199660)
-MetaBoardTest:testEmitMeta(bytes32,bytes) (runs: 5099, μ: 207801, ~: 207693)
+LibDescribedByMetaEmitForDescribedAddressTest:testEmitForDescribedAddressHappy(bytes) (runs: 5096, μ: 267020, ~: 266892)
+LibDescribedByMetaEmitForDescribedAddressTest:testEmitForDescribedAddressMismatch(bytes,bytes) (runs: 5093, μ: 269394, ~: 269260)
+LibMetaCheckMetaHashedV1_2Test:testCheckMetaHashedV1_2BadMagicBadHash(bytes,bytes32) (runs: 5096, μ: 6031, ~: 5974)
+LibMetaCheckMetaHashedV1_2Test:testCheckMetaHashedV1_2BadMagicGoodHash(bytes) (runs: 5096, μ: 6515, ~: 6334)
+LibMetaCheckMetaHashedV1_2Test:testCheckMetaHashedV1_2GoodMagicBadHash(bytes,bytes32) (runs: 5096, μ: 6383, ~: 6321)
+LibMetaCheckMetaHashedV1_2Test:testCheckMetaHashedV1_2Happy(bytes) (runs: 5096, μ: 1275, ~: 1228)
+LibMetaCheckMetaUnhashedV1_2Test:testCheckMetaUnhashedV1_2Fuzz(bytes) (runs: 5096, μ: 6780, ~: 6564)
+LibMetaIsRainMetaV1_2Test:testIsRainMetaV1_2Fuzz(bytes) (runs: 5096, μ: 1197, ~: 1153)
+MetaBoardHashTest:testMetaboardHash(bytes) (runs: 5096, μ: 200262, ~: 200200)
+MetaBoardTest:testEmitMeta(bytes32,bytes) (runs: 5096, μ: 212497, ~: 212154)

foundry.lock

@@ -0,0 +1,5 @@
+{
+  "lib/forge-std": {
+    "rev": "b8f065fda83b8cd94a6b2fec8fcd911dc3b444fd"
+  }
+}

src/concrete/MetaBoard.sol

@@ -16,6 +16,12 @@ contract MetaBoard is IMetaBoardV1_2 {
     /// under its hash. This avoids the need to roll a new interface to include
     /// hashes in the event logs.
     function hash(bytes calldata data) external pure returns (bytes32) {
-        return keccak256(data);
+        bytes32 dataHash;
+        assembly ("memory-safe") {
+            let free := mload(0x40)
+            calldatacopy(free, data.offset, data.length)
+            dataHash := keccak256(free, data.length)
+        }
+        return dataHash;
     }
 }

src/interface/unstable/IMetaV1_2.sol

@@ -2,6 +2,7 @@
 // SPDX-FileCopyrightText: Copyright (c) 2020 Rain Open Source Software Ltd
 pragma solidity ^0.8.19;
 
+//forge-lint: disable-next-line(unused-import)
 import {UnexpectedMetaHash, NotRainMetaV1, META_MAGIC_NUMBER_V1} from "../deprecated/IMetaV1.sol";
 
 /// @title IMetaV1_2

src/lib/LibDescribedByMeta.sol

@@ -13,7 +13,10 @@ library LibDescribedByMeta {
         internal
     {
         bytes32 expected = described.describedByMetaV1();
-        bytes32 actual = keccak256(meta);
+        bytes32 actual;
+        assembly ("memory-safe") {
+            actual := keccak256(add(meta, 0x20), mload(meta))
+        }
         if (actual != expected) {
             revert MetadataMismatch(described, expected, actual);
         }

src/lib/LibMeta.sol

@@ -2,6 +2,7 @@
 // SPDX-FileCopyrightText: Copyright (c) 2020 Rain Open Source Software Ltd
 pragma solidity ^0.8.19;
 
+//forge-lint: disable-next-line(unused-import)
 import {IMetaV1_2, UnexpectedMetaHash, NotRainMetaV1, META_MAGIC_NUMBER_V1} from "../interface/unstable/IMetaV1_2.sol";
 
 /// @title LibMeta
@@ -36,7 +37,10 @@ library LibMeta {
     /// `isRainMetaV1` OR it does not match the expected hash of its data.
     /// @param meta The metadata to check.
     function checkMetaHashedV1(bytes32 expectedHash, bytes memory meta) internal pure {
-        bytes32 actualHash = keccak256(meta);
+        bytes32 actualHash;
+        assembly ("memory-safe") {
+            actualHash := keccak256(add(meta, 0x20), mload(meta))
+        }
         if (expectedHash != actualHash) {
             revert UnexpectedMetaHash(expectedHash, actualHash);
         }

test/lib/LibDescribedByMeta.emitForDescribedAddress.t.sol

@@ -10,14 +10,14 @@ import {MetaBoard} from "src/concrete/MetaBoard.sol";
 import {META_MAGIC_NUMBER_V1} from "src/interface/unstable/IMetaV1_2.sol";
 
 contract TestDescribedByMetaV1 is IDescribedByMetaV1 {
-    bytes32 public immutable expected;
+    bytes32 public immutable EXPECTED;
 
     constructor(bytes memory meta) {
-        expected = keccak256(meta);
+        EXPECTED = keccak256(meta);
     }
 
     function describedByMetaV1() external view override returns (bytes32) {
-        return expected;
+        return EXPECTED;
     }
 }
 

test/lib/LibMeta.checkMetaUnhashedV1_2.t.sol

@@ -4,7 +4,7 @@ pragma solidity =0.8.25;
 
 import {Test} from "forge-std/Test.sol";
 import {LibMeta} from "src/lib/LibMeta.sol";
-import {UnexpectedMetaHash, NotRainMetaV1, META_MAGIC_NUMBER_V1} from "src/interface/unstable/IMetaV1_2.sol";
+import {NotRainMetaV1, META_MAGIC_NUMBER_V1} from "src/interface/unstable/IMetaV1_2.sol";
 
 contract LibMetaCheckMetaUnhashedV1_2Test is Test {
     function checkMetaUnhashedV1External(bytes memory meta) external pure {

test/lib/LibMeta.isRainMetaV1_2.t.sol

@@ -4,7 +4,7 @@ pragma solidity =0.8.25;
 
 import {Test} from "forge-std/Test.sol";
 import {LibMeta} from "src/lib/LibMeta.sol";
-import {UnexpectedMetaHash, NotRainMetaV1, META_MAGIC_NUMBER_V1} from "src/interface/unstable/IMetaV1_2.sol";
+import {META_MAGIC_NUMBER_V1} from "src/interface/unstable/IMetaV1_2.sol";
 
 contract LibMetaIsRainMetaV1_2Test is Test {
     /// All data with the magic number prefix will be considered to be rain meta