Signature Validity Duration

[juddydev]

The contract does not limit the validity period of signatures, potentially allowing a claim to be valid indefinitely. Adding a timestamp to the signature data and verifying that the signature is recent would mitigate this issue.

function _validateClaimParams(
uint256 _amount,
address _claimer,
bytes calldata _signature,
uint256 _timestamp
) internal view returns (bool) {
require(block.timestamp <= _timestamp + 1 days, "Signature expired");
bytes32 hash = keccak256(abi.encodePacked(_claimer, _amount, _timestamp));
bytes32 message = ECDSA.toEthSignedMessageHash(hash);
address recoveredAddress = ECDSA.recover(message, _signature);
return (recoveredAddress == signer);
}