iktok90-design/ai-smart-contract-auditor/signature-replay

Signature replay & EIP-712 detection

When this applies

• ecrecover and any signature verification path
• permit (EIP-2612, ERC-4494) implementations
• Meta-tx / gasless flows (ERC-2771, EIP-3074 / EIP-7702 wrapping)
• Signed off-chain orders (0x, Seaport, custom)
• Signed governance votes
• Validator-set / bridge signature aggregation (see [[bridge-specialist]])

Detection patterns

Missing nonce (CRITICAL)

bytes32 digest = keccak256(abi.encode(sender, amount));   // ← no nonce, infinitely replayable
require(ecrecover(digest, v, r, s) == sender);

Missing chainId in domain (CRITICAL — cross-chain replay)

EIP-712 domain MUST include chainId. Without it, signing on Ethereum replays on Optimism/Arbitrum/etc.

bytes32 domain = keccak256(abi.encode(EIP712_DOMAIN, name, version, /* no chainId */ , verifyingContract));

Hardcoded chainId / _DOMAIN_SEPARATOR cached without fork-detect (HIGH)

DOMAIN_SEPARATOR = _hashDomain(block.chainid);   // ← cached in constructor, breaks after fork

Re-compute when block.chainid differs.

Signature malleability (HIGH)

ECDSA accepts both (r, s) and (r, n-s) for valid signatures. If you use the digest as a uniqueness key, attacker can flip s and replay. Enforce s ≤ secp256k1n/2 and v ∈ {27, 28}. Or use OpenZeppelin's ECDSA.tryRecover which already does this.

ecrecover returns address(0) on invalid sig — not reverted (HIGH)

address signer = ecrecover(digest, v, r, s);   // returns 0 on bad sig
require(roles[signer]);   // ← if roles[address(0)] is ever true (default mapping behavior), it bypasses

Always require(signer != address(0)) after ecrecover, or use OZ ECDSA.

Replay across contracts (HIGH)

Missing address(this) / verifyingContract in the signed payload. Same admin sig usable on multiple deployments.

Front-running of permit (MEDIUM)

See [[mev-frontrunning]] §permit.

Approval-front-run via signed message (HIGH)

Off-chain signed orders where the maker can replay across fills if the order doesn't include salt + nonce + cancellation mechanism.

Permit2 confusion (HIGH)

Mixing Permit2's SignatureTransfer (one-shot) vs AllowanceTransfer (persistent). Read the contract's docs carefully.

Severity rubric

Remediation patterns

• Use OZ EIP712 base + ECDSA.recover — handles s-bound, malleability, zero-address.
• Include in every signed payload: chainId, verifyingContract, nonce, deadline, plus any operation-specific fields.
• Re-derive DOMAIN_SEPARATOR lazily when block.chainid != cached_chainid.
• Nonces: per-signer monotonic OR per-order salt + on-chain seen-bitmap.
• For ERC-1271 (contract signers), validate via isValidSignature(bytes32, bytes) returning the magic value.

False-positive notes

• Single-use bound to a specific consumed-event flag isn't strictly replayable — but still flag if the bound is fragile.
• Pure off-chain signatures never submitted on-chain don't have replay risk on chain, but watch for accidental reuse.

Related

• [[access-control]]
• [[bridge-specialist]] — validator set signatures
• [[mev-frontrunning]]