Signature malleability not protected against

[code423n4]

Lines of code

https://github.com/code-423n4/2023-07-lens/blob/cdef6ebc6266c44c7068bc1c4c04e12bf0d67ead/contracts/LensHub.sol#L382-L394

Vulnerability details

Impact

A signature should never be included into a signed message hash to check if previously messages have been processed by the contract.

See reference: https://swcregistry.io/docs/SWC-117

Proof of Concept

Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept.

instances:

https://github.com/code-423n4/2023-07-lens/blob/cdef6ebc6266c44c7068bc1c4c04e12bf0d67ead/contracts/LensHub.sol#L124-L125

https://github.com/code-423n4/2023-07-lens/blob/cdef6ebc6266c44c7068bc1c4c04e12bf0d67ead/contracts/LensHub.sol#L382-L394

https://github.com/code-423n4/2023-07-lens/blob/cdef6ebc6266c44c7068bc1c4c04e12bf0d67ead/contracts/LensHub.sol#L356-L357

https://github.com/code-423n4/2023-07-lens/blob/cdef6ebc6266c44c7068bc1c4c04e12bf0d67ead/contracts/LensHub.sol#L412-L413

https://github.com/code-423n4/2023-07-lens/blob/cdef6ebc6266c44c7068bc1c4c04e12bf0d67ead/contracts/LensHub.sol#L441-L442

https://github.com/code-423n4/2023-07-lens/blob/cdef6ebc6266c44c7068bc1c4c04e12bf0d67ead/contracts/LensHub.sol#L478-L479

https://github.com/code-423n4/2023-07-lens/blob/cdef6ebc6266c44c7068bc1c4c04e12bf0d67ead/contracts/LensHub.sol#L182-L189

and every other signature validator that has not been implemented.

function unfollowWithSig(
       uint256 unfollowerProfileId,
       uint256[] calldata idsOfProfilesToUnfollow,
       Types.EIP712Signature calldata signature
   ) external override whenNotPaused onlyProfileOwnerOrDelegatedExecutor(signature.signer, unfollowerProfileId) {
       MetaTxLib.validateUnfollowSignature(signature, unfollowerProfileId, idsOfProfilesToUnfollow);

       FollowLib.unfollow({
           unfollowerProfileId: unfollowerProfileId,
           idsOfProfilesToUnfollow: idsOfProfilesToUnfollow,
           transactionExecutor: signature.signer
       });
   }

Tools Used

vscode

Recommended Mitigation Steps

Consider using OpenZeppelin’s ECDSA library: https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/utils/cryptography/ECDSA.sol

Assessed type

Other

[c4-pre-sort]

141345 marked the issue as duplicate of #52

[c4-judge]

Picodes marked the issue as unsatisfactory: Invalid