signature-vulnerabilities

# Signature Vulnerabilities ## Replay Attacks A valid signature can be reused unless explicitly prevented. ### Cross-Chain Replay A signature valid on Ethereum mainnet can be replayed on Arbitrum, Optimism, etc. ```solidity // VULNERABLE: no chain ID in signed data bytes32 hash = keccak256(abi.encodePacked(user, amount, nonce)); // FIXED: include chain ID via EIP-712 domain separator bytes32 public immutable DOMAIN_SEPARATOR; constructor() { DOMAIN_SEPARATOR = keccak256(abi.encode( keccak256("EIP712Domain(string name,string version,uint256 chainId,address verifyingContract)"), keccak256(bytes("MyProtocol")), keccak256(bytes("1")), block.chainid, address(this) )); } ``` ### Cross-Contract Replay A signature for contract A can be replayed on contract B if the verifying contract address isn't included. **Defense**: Always include `address(this)` in the domain separator (EIP-712 handles this). ### Same-Contract Replay Reusing a signature multiple times on the same contract. **Defense**: Nonce tracking. ```solidity mapping(address => uint256) public nonces; function executeWithSignature( address user, uint256 amount, uint256 deadline, uint8 v, bytes32 r, bytes32 s ) external { if (block.timestamp > deadline) revert Expired(); bytes32 structHash = keccak256(abi.encode( EXECUTE_TYPEHASH, user, amount, nonces[user]++, deadline )); bytes32 digest = keccak256(abi.encodePacked("\x19\x01", DOMAIN_SEPARATOR, structHash)); address recovered = ecrecover(digest, v, r, s); if (recovered == address(0) || recovered != user) revert InvalidSignature(); _execute(user, amount); } ``` ## EIP-712 Typed Data Signing The standard for structured data signing. Provides human-readable signing prompts in wallets. ```solidity bytes32 public constant EXECUTE_TYPEHASH = keccak256( "Execute(address user,uint256 amount,uint256 nonce,uint256 deadline)" ); function _hashTypedData(bytes32 structHash) internal view returns (bytes32) { return keccak256(abi.encodePacked("\x19\x01", DOMAIN_SEPARATOR, structHash)); } ``` ### Nested Struct Hashing ```solidity // For complex types, hash inner structs first bytes32 constant ORDER_TYPEHASH = keccak256( "Order(address maker,Asset makerAsset,Asset takerAsset,uint256 nonce,uint256 deadline)" "Asset(address token,uint256 amount)" ); bytes32 constant ASSET_TYPEHASH = keccak256( "Asset(address token,uint256 amount)" ); function hashOrder(Order memory order) internal pure returns (bytes32) { return keccak256(abi.encode( ORDER_TYPEHASH, order.maker, hashAsset(order.makerAsset), hashAsset(order.takerAsset), order.nonce, order.deadline )); } function hashAsset(Asset memory asset) internal pure returns (bytes32) { return keccak256(abi.encode(ASSET_TYPEHASH, asset.token, asset.amount)); } ``` ## Signature Malleability ECDSA signatures have two valid forms for the same message (s and n-s). If both are accepted, a signature can be "replayed" with the alternate form. ```solidity // VULNERABLE: accepts both s values address recovered = ecrecover(hash, v, r, s); // FIXED: enforce low-s value (EIP-2 canonical form) function _verifySignature(bytes32 hash, uint8 v, bytes32 r, bytes32 s) internal pure returns (address) { // s must be in the lower half of the curve order if (uint256(s) > 0x7FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF5D576E7357A4501DDFE92F46681B20A0) { revert MalleableSignature(); } address recovered = ecrecover(hash, v, r, s); if (recovered == address(0)) revert InvalidSignature(); return recovered; } ``` **Best practice**: Use OpenZeppelin's ECDSA library which handles malleability checks. ```solidity import {ECDSA} from "@openzeppelin/contracts/utils/cryptography/ECDSA.sol"; import {MessageHashUtils} from "@openzeppelin/contracts/utils/cryptography/MessageHashUtils.sol"; function verify(bytes32 hash, bytes memory signature) internal pure returns (address) { return ECDSA.recover(hash, signature); // handles malleability check } ``` ## ecrecover Returns address(0) `ecrecover` returns `address(0)` for invalid signatures instead of reverting. Always check. ```solidity // VULNERABLE: doesn't check for address(0) address signer = ecrecover(hash, v, r, s); require(signer == expectedSigner); // passes if expectedSigner is address(0) // FIXED: explicit zero check address signer = ecrecover(hash, v, r, s); if (signer == address(0)) revert InvalidSignature(); if (signer != expectedSigner) revert Unauthorized(); ``` ## EIP-2612 Permit Front-Running An attacker can front-run a `permit` + action transaction by extracting the permit signature and calling `permit` first. The user's transaction reverts because the nonce is consumed. ```solidity // VULNERABLE: permit reverts if already used function depositWithPermit( uint256 amount, uint256 deadline, uint8 v, bytes32 r, bytes32 s ) external { token.permit(msg.sender, address(this), amount, deadline, v, r, s); // ← reverts if front-run token.safeTransferFrom(msg.sender, address(this), amount); } // FIXED: try/catch on permit, proceed if allowance already set function depositWithPermit( uint256 amount, uint256 deadline, uint8 v, bytes32 r, bytes32 s ) external { try token.permit(msg.sender, address(this), amount, deadline, v, r, s) {} catch {} token.safeTransferFrom(msg.sender, address(this), amount); } ``` ## Nonce Management Patterns ### Sequential Nonces Simple, prevents replay, but requires sequential use. ```solidity mapping(address => uint256) public nonces; // User must use nonce 0, then 1, then 2, etc. // Cancel a nonce by calling with a no-op payload ``` ### Bitmap Nonces (Permit2 style) Allows out-of-order nonce consumption. ```solidity // Nonces stored as bitmaps: nonce 256*wordPos + bitPos mapping(address => mapping(uint256 => uint256)) public nonceBitmap; function _useNonce(address owner, uint256 nonce) internal { uint256 wordPos = nonce >> 8; uint256 bitPos = nonce & 0xff; uint256 bit = 1 << bitPos; uint256 word = nonceBitmap[owner][wordPos]; if (word & bit != 0) revert NonceAlreadyUsed(); nonceBitmap[owner][wordPos] = word | bit; } ``` ## Signature Verification Checklist - [ ] EIP-712 domain separator includes chainId and verifyingContract - [ ] Domain separator recomputed if chainId can change (forking) - [ ] Nonce included and incremented to prevent replay - [ ] Deadline/expiry included for time-bound signatures - [ ] ecrecover result checked against address(0) - [ ] Signature malleability mitigated (low-s check or OZ ECDSA) - [ ] Permit calls wrapped in try/catch to prevent front-running griefing - [ ] Typed data hashing follows EIP-712 spec exactly - [ ] Offchain signing tested against onchain verification