moved actual nonce to least significant bits

Author: mgretzke

src/allocators/ERC7683Allocator.sol

@@ -276,11 +276,11 @@ contract ERC7683Allocator is SimpleAllocator, IERC7683Allocator {
     }
 
     function _checkNonce(address sponsor_, uint256 nonce_) internal pure {
-        // Enforce a nonce where the most significant 96 bits are the nonce and the least significant 160 bits are the sponsor
+        // Enforce a nonce where the least significant 96 bits are the nonce and the most significant 160 bits are the sponsors address
         // This ensures that the nonce is unique for a given sponsor
         address expectedSponsor;
         assembly ("memory-safe") {
-            expectedSponsor := shr(96, shl(96, nonce_))
+            expectedSponsor := shr(96, nonce_)
         }
         if (expectedSponsor != sponsor_) {
             revert InvalidNonce(nonce_);

test/ERC7683Allocator.t.sol

@@ -69,7 +69,7 @@ abstract contract MocksSetup is Test {
         });
         usdcId = IdLib.toId(lock);
         (attacker, attackerPK) = makeAddrAndKey('attacker');
-        defaultNonce = uint256(bytes32(abi.encodePacked(uint96(1), user)));
+        defaultNonce = uint256(bytes32(abi.encodePacked(user, uint96(1))));
 
         ORDERDATA_GASLESS_TYPEHASH = erc7683Allocator.ORDERDATA_GASLESS_TYPEHASH();
         ORDERDATA_TYPEHASH = erc7683Allocator.ORDERDATA_TYPEHASH();
@@ -940,7 +940,7 @@ contract ERC7683Allocator_checkNonce is OnChainCrossChainOrderData {
         address sponsor = user;
         uint256 nonce;
         assembly ("memory-safe") {
-            nonce := or(shl(160, nonce_), shr(96, shl(96, sponsor)))
+            nonce := or(shl(96, sponsor), shr(160, shl(160, nonce_)))
         }
         assertEq(erc7683Allocator.checkNonce(sponsor, nonce), true);
     }