Medium Severity: Missing Seller Nonce Validation in DVPEngine

[Agungim79]

Hello Setra Security Team,

I am reporting a Medium-severity issue in setra-core on the main branch.

Title:
Seller nonce is not validated, allowing replay of stale seller intents

Affected component:
src/settlement/DVPEngine.sol
Function: _validateAndHash()

Summary:
_validateAndHash() validates the buyer nonce but does not validate the seller nonce, even though the seller nonce is incremented after each successful settlement.

This allows a seller to sign multiple distinct settlement intents with the same nonce. After one intent is executed and the seller nonce increases, another intent using the same seller nonce can still be executed because the contract does not check the seller’s current nonce.

Impact:
The issue weakens seller-side replay protection and may allow buyers to execute and pay for multiple stale seller intents. The second settlement still requires the seller to provide the required token balance, so this does not independently demonstrate simultaneous double-spending of the same token balance.

Severity:
Medium

Reproduction:

1. Seller nonce, Buyer 1 nonce, and Buyer 2 nonce are initially 0.
2. Seller signs two different intents with nonce 0, targeting different buyers.
3. Buyer 1 executes the first intent successfully.
4. Seller nonce becomes 1.
5. Seller provides the required token balance again.
6. Buyer 2 executes the second intent with seller nonce 0.
7. The second intent succeeds because only the buyer nonce is validated.

Expected behavior:
The second intent should revert because the seller nonce is stale.

Recommended fix:
Add seller nonce validation:

if (_nonces[intent.seller] != intent.nonce) {
revert Settlement_NonceMismatch();
}

A longer-term fix is to use separate buyerNonce and sellerNonce fields in DVPIntent and validate each independently.

The attached materials include the full technical report, reproduction steps, and recommended regression tests.

Please confirm receipt and let me know if additional information or a different disclosure format is required.

Regards,
Agung Imani

setra-seller-nonce-report.md
forge-test-output.txt