Using built in EVM's ecrecover is prone to signature malleability, therefore it is recommended to use ECDSA.recover from openzeppelin library which will validate the values of v and s in signatures.
Attack Scenario
Openzeppelin states the following bug from ecrecover and how to counter it with further validation of v and s value of signature used in ECDSA.tryrecover of openzeppelin library.
// EIP-2 still allows signature malleability for ecrecover(). Remove this possibility and make the signature
// unique. Appendix F in the Ethereum Yellow paper (https://ethereum.github.io/yellowpaper/paper.pdf), defines
// the valid range for s in (301): 0 < s < secp256k1n ÷ 2 + 1, and for v in (302): v ∈ {27, 28}. Most
// signatures from current libraries generate a unique signature with an s-value in the lower half order.
//
// If your library generates malleable signatures, such as s-values in the upper range, calculate a new s-value
// with 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141 - s1 and flip v from 27 to 28 or
// vice versa. If your library also generates signatures with 0/1 for v instead 27/28, add 27 to v to accept
// these malleable signatures as well.
/* The `ecrecover` EVM precompile allows for malleable (non-unique) signatures:
this function rejects them by requiring the `s` value to be in the lower
half order, and the `v` value to be either 27 or 28. */
Attachments
NA
Proof of Concept (PoC) File
In contracts/core/VotingEscrowUpgradeable.sol::delegateBySig:
Github username: @erictee2802 Twitter username: 0xEricTee Submission hash (on-chain): 0x64f5a807cbfc4a5161a0b36f5eb14a6bbc07c55bedf9d9b7eb38402cb661d3ab Severity: medium
Description: Description
Using built in EVM's
ecrecover
is prone to signature malleability, therefore it is recommended to useECDSA.recover
from openzeppelin library which will validate the values ofv
ands
in signatures.Attack Scenario
Openzeppelin states the following bug from ecrecover and how to counter it with further validation of v and s value of signature used in ECDSA.tryrecover of openzeppelin library.
https://github.com/OpenZeppelin/openzeppelin-contracts/blob/9e3f4d60c581010c4a3979480e07cc7752f124cc/contracts/utils/cryptography/ECDSA.sol#L119-L145
https://github.com/OpenZeppelin/openzeppelin-contracts/blob/9e3f4d60c581010c4a3979480e07cc7752f124cc/contracts/utils/cryptography/ECDSA.sol#L39-L70
Attachments
NA
In
contracts/core/VotingEscrowUpgradeable.sol::delegateBySig
:It is recommended to use the
recover()
function from OpenZeppelin’s ECDSA library for signature verification