Summary
ExactCalldataBatchEnforcer terms are encoded as Execution[] (target, value, calldata), but beforeHook only compares calldata. A redeemer can reuse the same calldata against a different target (or attach native value).
Sibling enforcer ExactExecutionBatchEnforcer already pins the full execution. Single-call ExactCalldataEnforcer correctly treats terms as raw calldata only; the batch variant's terms ABI implies the fuller check.
Proposal
In the batch loop, also require target and value equality with the terms executions (fail closed), plus regression tests for target-swap and non-zero value.
Happy to open a PR against main.
Summary
ExactCalldataBatchEnforcerterms are encoded asExecution[](target, value, calldata), butbeforeHookonly compares calldata. A redeemer can reuse the same calldata against a differenttarget(or attach nativevalue).Sibling enforcer
ExactExecutionBatchEnforceralready pins the full execution. Single-callExactCalldataEnforcercorrectly treats terms as raw calldata only; the batch variant's terms ABI implies the fuller check.Proposal
In the batch loop, also require
targetandvalueequality with the terms executions (fail closed), plus regression tests for target-swap and non-zero value.Happy to open a PR against
main.