Quadrata Passport - Audit (Addendum)

```solidity bytes32 extractionHash = keccak256( abi.encode( _account, _config.attrKeys, _config.attrValues, _config.did, _config.verifiedAt, _config.issuedAt, _config.fee, block.chainid, address(this) ) ); ``` The `_setAttributesVerify()` function in the contract verifies a signature based on a specific set of input parameters. However, the `_config.tokenId` and `_config.attrTypes` variables are not included in the signature verification process. This could potentially allow an attacker to exploit the vulnerability and mint a token with an unexpected tokenId or assign `attrValues` in an unexpected order corresponding to `attrTypes`.

The `attributeMetadata()` function is used to return the `issuedAt` variable of an attribute. ```solidity issuedAts[attributeIndex] = attribute.epoch; ``` However, in the `_setAttributesInternal()` function where the attribute is written, the `epoch` variable is actually the `verifiedAt` variable. As a result, the `attributeMetadata()` function may return an inaccurate `issuedAt` value. ```solidity _writeAttrToStorage( _computeAttrKey(_account, ATTRIBUTE_DID, _config.did, _issuer), _config.did, _config.verifiedAt); ```

```solidity @param _attrKey attribute key (i.e. keccak256(address, keccak256("AML"))) ``` The comment of the function `_writeAttrToStorage()` is incorrect, an example of the attribute key is `keccak256(address, keccak256("AML"), address)`. The `setAttributesIssuer()` function is named and commented to imply that it should only be called by authorized issuers. However, it can be called by anyone.