Closed sherlock-admin3 closed 4 months ago
This is only possible if the original caller uses a signature with an S-value in the vulnerable range, which no commonly used Ethereum client libs allow. Won't fix.
Escalate
It is a duplicate of issue #279, not #284. Additionally, issue #279 is not a duplicate of issue #273.
Escalate
It is a duplicate of issue #279, not #284. Additionally, issue #279 is not a duplicate of issue #273.
You've created a valid escalation!
To remove the escalation from consideration: Delete your comment.
You may delete or edit your escalation comment anytime before the 48-hour escalation window closes. After that, the escalation becomes final.
Agree with the escalation, planning to accept and duplicate with #279
Result: Medium Duplicate of #279
fibonacci
high
TitlesGraph's acknowledge/unacknowledge edge functions are vulnerable to signature malleability
Summary
Valid signatures could be crafted by a malicious user to replay previously signed messages.
Vulnerability Detail
A user can acknowledge an edge using an ECDSA signature.
The signed message hash is used to check if previously messages have been processed by the contract.
A malicious user can slightly modify the three values v, r, and s to create other valid signatures. In this case, the signature will be valid, but the hash will be different, allowing the check above to pass. (Reference)
To validate the signature,
TitlesGraph
utilizesSignatureCheckerLib
by solady, which does not include a check for non-malleability, assuming that the signed message will contain a nonce. (Reference)However, it is observed that the nonce is not included in the message.
Impact
The state of acknowledging or unacknowledging an edge can be reset by a malicious user.
Example:
Code Snippet
https://github.com/sherlock-audit/2024-04-titles/blob/main/wallflower-contract-v2/src/graph/TitlesGraph.sol#L118-L124 https://github.com/sherlock-audit/2024-04-titles/blob/main/wallflower-contract-v2/src/graph/TitlesGraph.sol#L146-L152 https://github.com/sherlock-audit/2024-04-titles/blob/main/wallflower-contract-v2/src/graph/TitlesGraph.sol#L40-L50
Tool used
Manual Review
Recommendation
Include the nonce in the signed message.
Duplicate of #279