search

RiskProtocol / core-protocol

1 stars 0 forks source link

Malleability ecrecover issue #121

Closed mz7mz7mz7 closed 10 months ago

mz7mz7mz7 commented 1 year ago

To review if we are immune to this issue: https://github.com/code-423n4/2021-08-realitycards-findings/issues/63 https://ethereum.stackexchange.com/questions/83174/is-it-best-practice-to-check-signature-malleability-in-ecrecover https://journal0xrusowsky.substack.com/p/digital-signatures-ecrecover https://coders-errand.com/malleability-ecdsa-signatures/ https://soliditydeveloper.com/ecrecover https://0xsomeone.medium.com/b002-solidity-ec-signature-pitfalls-b24a0f91aef4 https://twitter.com/gogotheauditor/status/1611667787759616000 https://twitter.com/immunefi/status/1481587081168277508?lang=en

FYI: @haidarally , @Tunji17

haidarally commented 11 months ago

@mz7mz7mz7 We are basically immune to this issue, as we make use of sequenceNumber, which is unique and can be consumed only once. I have also updated the code with OZ'ECDSA's lib instead of using inbuilt erecover. PR: https://github.com/RiskProtocol/core-protocol/pull/130