signature-replay

Signature Replay Playbook

EIP-712 signatures, permits, meta-transactions, and cross-chain bridges all use ecrecover (or its variants). Each has well-known bugs.

Bug classes

1. Missing nonce → replay

function execute(uint256 amount, bytes calldata sig) external {
    bytes32 h = keccak256(abi.encodePacked(msg.sender, amount));
    address signer = ecrecover(h, ...);
    require(signer == owner);
    // ... withdraw amount
}

A valid signature can be replayed forever — anyone who saw it once can re-submit it. Fix: include a per-user / per-message nonce:

mapping(address => uint256) public nonces;
function execute(uint256 amount, uint256 nonce, bytes calldata sig) external {
    require(nonce == nonces[msg.sender]);
    nonces[msg.sender]++;
    bytes32 h = keccak256(abi.encodePacked(msg.sender, amount, nonce));
    // ...
}

2. Missing chain ID → cross-chain replay

A signature valid on Ethereum mainnet shouldn't work on Optimism, Base, Arbitrum, etc. If chainid() not in the signed payload, signatures replay across chains:

// VULNERABLE
bytes32 h = keccak256(abi.encodePacked(amount, deadline, nonce));

// SAFE — EIP-712 domain separator includes chainid
bytes32 h = _hashTypedDataV4(...);  // OZ helper

This is especially bad for bridges — a signed message intended for chain A executes on chain B.

3. Signature malleability (ecrecover variants)

ecrecover accepts two valid s values for any signed message (s and -s mod n). This means each signature has two valid forms. If your contract uses the signature itself as a uniqueness key (e.g., usedSigs[sig] = true), an attacker can find the malleable version and bypass:

// VULNERABLE — uses sig as uniqueness key
mapping(bytes => bool) public used;
function execute(bytes calldata sig) external {
    require(!used[sig]);
    used[sig] = true;
    address signer = ecrecover(...);
    // ...
}

Fix: use the message hash (not the signature) as uniqueness key. Modern OZ ECDSA library rejects high-s values, but home-rolled ecrecover does not.