search

code-423n4 / 2022-01-livepeer-findings

0 stars 0 forks source link

recoverSigner returns an empty address when the signature is empty #232

Closed code423n4 closed 2 years ago

code423n4 commented 2 years ago

Handle

pauliax

Vulnerability details

Impact

Function recoverSigner in L1Migrator returns an empty address if the signature is empty:

  if (_sig.length == 0) {
      return address(0);
  }

This means you can bypass the signature verification by passing an empty signature and an empty address for _l1Addr. Then you can specify any _l2Addr and it will work.

Recommended Mitigation Steps

It should revert when the signature is empty or just let the ECDSA.recover reject it.

yondonfu commented 2 years ago

Duplicate of https://github.com/code-423n4/2022-01-livepeer-findings/issues/142