Signature Replay

Signature Replay Playbook

EIP-712 signatures, permits, meta-transactions, and cross-chain bridges all use ecrecover (or its variants). Each has well-known bugs.

Bug classes

1. Missing nonce → replay

function execute(uint256 amount, bytes calldata sig) external {
    bytes32 h = keccak256(abi.encodePacked(msg.sender, amount));
    address signer = ecrecover(h, ...);
    require(signer == owner);
    // ... withdraw amount
}

A valid signature can be replayed forever — anyone who saw it once can re-submit it. Fix: include a per-user / per-message nonce:

mapping(address => uint256) public nonces;
function execute(uint256 amount, uint256 nonce, bytes calldata sig) external {
    require(nonce == nonces[msg.sender]);
    nonces[msg.sender]++;
    bytes32 h = keccak256(abi.encodePacked(msg.sender, amount, nonce));
    // ...
}

2. Missing chain ID → cross-chain replay

A signature valid on Ethereum mainnet shouldn't work on Optimism, Base, Arbitrum, etc. If chainid() not in the signed payload, signatures replay across chains:

// VULNERABLE
bytes32 h = keccak256(abi.encodePacked(amount, deadline, nonce));

// SAFE — EIP-712 domain separator includes chainid
bytes32 h = _hashTypedDataV4(...);  // OZ helper

This is especially bad for bridges — a signed message intended for chain A executes on chain B.

3. Signature malleability (ecrecover variants)

ecrecover accepts two valid s values for any signed message (s and -s mod n). This means each signature has two valid forms. If your contract uses the signature itself as a uniqueness key (e.g., usedSigs[sig] = true), an attacker can find the malleable version and bypass:

// VULNERABLE — uses sig as uniqueness key
mapping(bytes => bool) public used;
function execute(bytes calldata sig) external {
    require(!used[sig]);
    used[sig] = true;
    address signer = ecrecover(...);
    // ...
}

Fix: use the message hash (not the signature) as uniqueness key. Modern OZ ECDSA library rejects high-s values, but home-rolled ecrecover does not.

4. ecrecover zero address on invalid sig

address signer = ecrecover(h, v, r, s);
if (signer == owner) { /* approve */ }

Bug: if (v,r,s) is invalid, ecrecover returns address(0). If owner is somehow address(0) (uninitialized!) → any malformed signature works. Fix: require(signer != address(0)).

5. Domain separator without chainid

EIP-712 domain separator should bind to the chain. If a protocol caches DOMAIN_SEPARATOR in storage at deployment, hard-forks (which change chainid) break it. OZ's EIP712 handles this; custom code often doesn't.

// VULNERABLE — cached at deploy
bytes32 immutable DOMAIN_SEPARATOR = keccak256(abi.encode(
    keccak256("EIP712Domain(...)"),
    keccak256(bytes("Name")),
    keccak256(bytes("1")),
    1,  // ← hardcoded chainid
    address(this)
));

// SAFE — re-derive when chainid changes
function _domainSeparator() internal view returns (bytes32) {
    return keccak256(abi.encode(..., block.chainid, ...));
}

6. Permit signature replay across forks / hard forks

ERC2612 permit is meta-tx for ERC20 approvals. If permit doesn't include the EIP-712 domain separator correctly, it can be replayed on:

• Forked test chains
• L2s that copied the contract
• Hard forks (ETC, ETHW)

This is mostly resolved by OZ ERC20Permit, but custom permit impls are often wrong.

7. Replay across function selectors

A signed payload keccak256(amount, recipient) is the same regardless of which function it authorizes. If two functions share the same hash structure but different effects, the signature replays:

function withdraw(uint256 amt, address to, bytes sig) external {
    bytes32 h = keccak256(abi.encodePacked(amt, to));
    address s = ecrecover(h, ...);
    require(s == owner);
    payable(to).transfer(amt);
}

function mint(uint256 amt, address to, bytes sig) external {
    bytes32 h = keccak256(abi.encodePacked(amt, to));  // SAME HASH
    address s = ecrecover(h, ...);
    require(s == owner);
    _mint(to, amt);
}
// A withdraw signature works for mint, and vice versa

Fix: include function selector or unique typeID in the signed payload.

Audit steps

1. Find every ecrecover

grep -rn 'ecrecover\|ECDSA.recover\|recover(' src/

2. For each call site, verify the payload contains

• A nonce (or other per-user unique value, like deadline + msg.sender)
• block.chainid (or use EIP-712 domain separator)
• A function discriminator (if multiple functions use signatures)
• address(this) (so signature is bound to THIS contract)

3. Verify signature validation

• Reject address(0) return from ecrecover
• Use OZ ECDSA library or equivalent that rejects high-s malleable signatures
• Domain separator re-derived from block.chainid if cached

4. Look for the dangerous patterns

# Custom ecrecover w/o OZ — often missing s-malleability check
grep -rn 'ecrecover' src/ | grep -v 'ECDSA.sol'

# Signature as uniqueness key
grep -rE 'mapping\(bytes' src/ | grep -i 'used\|nonce'

# Domain separator cached at deploy
grep -rn 'DOMAIN_SEPARATOR.*=.*keccak256' src/ | grep -v 'view\|pure'

PoC templates (Foundry)

Cross-chain replay

function test_cross_chain_replay() public {
    // 1. Sign payload on chain A (chainid 1)
    bytes32 hash = target.getSignableHash(amount, deadline);
    bytes memory sig = sign(privKey, hash);

    target.execute(amount, deadline, sig);  // works on chain A

    // 2. Switch to chain B (chainid 10)
    vm.chainId(10);

    // 3. Deploy same contract bytecode to chain B
    Target targetB = new Target(...);

    // 4. Same signature should be rejected if chainid is in the hash
    vm.expectRevert("invalid sig");
    targetB.execute(amount, deadline, sig);

    // If it DOES NOT revert → cross-chain replay bug
}

Malleability

function test_malleability() public {
    bytes32 hash = ...;
    (uint8 v, bytes32 r, bytes32 s) = sign(privKey, hash);

    target.execute(amount, abi.encodePacked(r, s, v));

    // Compute the malleable counterpart
    bytes32 sPrime = bytes32(uint256(SECP256K1_N) - uint256(s));
    uint8 vPrime = v == 27 ? 28 : 27;

    // If target doesn't reject high-s, this also works
    target.execute(amount, abi.encodePacked(r, sPrime, vPrime));
}

Missing nonce

function test_replay() public {
    target.execute(amount, sig);  // first call succeeds
    target.execute(amount, sig);  // if no nonce check, succeeds again
    // Attacker can drain by replaying N times
}

CVSS

• Missing nonce + signed withdraw fn: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8
• Cross-chain replay on bridge: 10.0 (Critical)
• Malleability + sig as uniqueness key: 8.0-9.0
• Domain separator missing chainid: 8.0
• ecrecover zero-address acceptance: 9.0 (engagement-ending if owner is 0)

Defender remediation

import "@openzeppelin/contracts/utils/cryptography/EIP712.sol";
import "@openzeppelin/contracts/utils/cryptography/ECDSA.sol";

contract Safe is EIP712 {
    using ECDSA for bytes32;

    mapping(address => uint256) public nonces;

    bytes32 constant TYPEHASH = keccak256(
        "Execute(address user,uint256 amount,uint256 nonce,uint256 deadline)"
    );

    constructor() EIP712("MyApp", "1") {}

    function execute(uint256 amount, uint256 deadline, bytes calldata sig) external {
        require(block.timestamp <= deadline, "expired");

        bytes32 structHash = keccak256(abi.encode(
            TYPEHASH, msg.sender, amount, nonces[msg.sender]++, deadline
        ));
        bytes32 hash = _hashTypedDataV4(structHash);
        address signer = hash.recover(sig);

        require(signer == owner, "bad sig");
        // OZ ECDSA already rejects address(0) and malleable s
    }
}

Known exemplars

• Wormhole (Feb 2022): $325M — signature verification bypass (different bug but same family)
• Nomad (Aug 2022): $190M — initial-merkle-root acceptance bug, replay-adjacent
• Multichain (Jul 2023): $126M — private-key compromise + over-broad signature acceptance
• Ronin (Mar 2022): $625M — validator-set takeover via cross-chain replay-like vector
• Cream V2 / Cover (Dec 2020): infinite-mint via nonce replay
• Compound c.Token reentrancy + sig-driven liquidations (smaller)
• ParaSwap (Sep 2021): signature malleability mitigated in ERC1271 wallet integrations