EIP-712 domain separator missing chainId
A code & audits factor in the v1.7.0 rubric. Measured per protocol on a s cadence.
Methodology how we score #
**What this measures** This factor assesses whether EIP-712 structured message signing in the protocol includes the chainId field in the domain separator. An EIP-712 domain separator that omits chainId allows a signed message valid on one chain to be replayed on any other chain where the protocol is deployed. The assessment is performed by static analysis of the domain separator construction in the protocol's verified source code.
**Why it matters** Cross-chain replay of signed messages is an underappreciated risk in multi-chain protocol deployments. If a protocol deploys to Ethereum, Arbitrum, and Base with the same contract logic and addresses, a permit() or governance vote signature from Ethereum can be submitted on Arbitrum and accepted as valid -- unless chainId is included in the domain separator. With approximately three documented hacks attributable to this pattern in the T-01 evidence base, and DeFi protocols increasingly deploying to five or more chains simultaneously, the absence of chainId in EIP-712 domain separators is a growing risk vector.
**Green / Yellow / Red** Green: all EIP-712 domain separators in deployed contracts include chainId, name, version, and verifyingContract fields as specified in the EIP. Yellow: chainId is included in the domain separator, but the domain separator is not recomputed on each verification call (cached domain separator pattern), creating a risk if the contract is ever deployed to a new chain with a cached stale separator. Red: any EIP-712 domain separator in the protocol omits the chainId field.
**Common gray cases** This factor is gray for protocols that do not use EIP-712 signing in any function path, including protocols with purely on-chain governance and no permit()-style functions.
Measurement what to look for #
Determine whether the EIP-712 domain separator struct omits the `chainId` field, allowing cross-chain replay.