iktok90-design/ai-smart-contract-auditor/erc1271-contract-signatures

ERC-1271 contract signatures detection

Background

ERC-1271 lets contract accounts (smart wallets, multisigs) sign messages. Verification call:

IERC1271(signer).isValidSignature(hash, sig) returns (bytes4 magicValue);
// magicValue must equal 0x1626ba7e

Without ERC-1271, smart-wallet users can't sign anything (no private key).

When this applies

• Off-chain order signing (Seaport, Blur, X2Y2)
• Permit2 with smart-wallet senders
• EIP-712 verification paths
• Any ecrecover(...) == signer check that might accept contract signers

Detection patterns

Bypass via ecrecover for smart wallet (HIGH)

require(ecrecover(hash, v, r, s) == signer, "bad sig");
// ← signer is a smart wallet, ecrecover returns address(0), check fails legitimately

The bug: contract owners can't sign at all. Add an ERC-1271 fallback:

if (signer.code.length > 0) {
    require(IERC1271(signer).isValidSignature(hash, abi.encodePacked(r, s, v)) == 0x1626ba7e);
} else {
    require(ecrecover(hash, v, r, s) == signer);
}

Wrong magic value check (HIGH)

require(IERC1271(signer).isValidSignature(hash, sig) == 0x1626ba7c);   // ← typo: should be 0x1626ba7e

Pre-EIP-1271 magic value (HIGH)

Some old impls return 0x20c13b0b (the legacy bytes-based variant). Spec is hash-based 0x1626ba7e. Mixing → reject valid sigs.

Replay via signature-update on smart wallet (HIGH)

A Safe's isValidSignature checks owner approvals. If signature is approved via on-chain approveHash then consumed, can it be re-approved later? Replay risk.

Smart wallet rotation breaks past sigs (LOW-MEDIUM)

If owner rotates, previously-validated signatures may now be valid by different signer logic. Depends on wallet impl.

Returning data length issues (HIGH)

ERC-1271 returns bytes4. Naive callers using staticcall + manual returndata parsing can mis-decode.

Gas griefing in isValidSignature (MEDIUM)

Smart wallet impl can spend unbounded gas in isValidSignature → relayer griefing.

ERC-1271 + Permit2 (HIGH)

Permit2 must handle contract signers. Apps that wrap Permit2 must too.

Severity rubric

Remediation patterns

• Use OZ SignatureChecker.isValidSignatureNow(signer, hash, sig) — handles both EOA and contract paths cleanly.
• Validate magicValue == 0x1626ba7e exactly.
• For Safe integration: use SignMessageLib and pre-approval flow.
• Bound gas: (bool ok, bytes memory ret) = signer.staticcall{gas: 100_000}(...).

False-positive notes

• Apps that explicitly don't support contract wallets (e.g. anti-Sybil) may intentionally reject. Confirm intent.

Related

• [[signature-replay]]
• [[permit2-patterns]]
• [[aa-specialist]] (subagent)