signature-vulnerabilities

Signature Vulnerabilities

Replay Attacks

A valid signature can be reused unless explicitly prevented.

Cross-Chain Replay

A signature valid on Ethereum mainnet can be replayed on Arbitrum, Optimism, etc.

// VULNERABLE: no chain ID in signed data
bytes32 hash = keccak256(abi.encodePacked(user, amount, nonce));

// FIXED: include chain ID via EIP-712 domain separator
bytes32 public immutable DOMAIN_SEPARATOR;

constructor() {
    DOMAIN_SEPARATOR = keccak256(abi.encode(
        keccak256("EIP712Domain(string name,string version,uint256 chainId,address verifyingContract)"),
        keccak256(bytes("MyProtocol")),
        keccak256(bytes("1")),
        block.chainid,
        address(this)
    ));
}

Cross-Contract Replay

A signature for contract A can be replayed on contract B if the verifying contract address isn't included.

Defense: Always include address(this) in the domain separator (EIP-712 handles this).

Same-Contract Replay

Reusing a signature multiple times on the same contract.

Defense: Nonce tracking.

mapping(address => uint256) public nonces;

function executeWithSignature(
    address user,
    uint256 amount,
    uint256 deadline,
    uint8 v, bytes32 r, bytes32 s
) external {
    if (block.timestamp > deadline) revert Expired();

    bytes32 structHash = keccak256(abi.encode(
        EXECUTE_TYPEHASH,
        user,
        amount,
        nonces[user]++,
        deadline
    ));

    bytes32 digest = keccak256(abi.encodePacked("\x19\x01", DOMAIN_SEPARATOR, structHash));

    address recovered = ecrecover(digest, v, r, s);
    if (recovered == address(0) || recovered != user) revert InvalidSignature();

    _execute(user, amount);
}

EIP-712 Typed Data Signing

The standard for structured data signing. Provides human-readable signing prompts in wallets.

bytes32 public constant EXECUTE_TYPEHASH = keccak256(
    "Execute(address user,uint256 amount,uint256 nonce,uint256 deadline)"
);

function _hashTypedData(bytes32 structHash) internal view returns (bytes32) {
    return keccak256(abi.encodePacked("\x19\x01", DOMAIN_SEPARATOR, structHash));
}