/signature-replay

name: signature-replay
description: Detect signature-replay, EIP-712 / EIP-2612 mistakes, malleable signatures, cross-chain replay, missing nonces. Activate on `ecrecover`, `permit`, meta-transactions, signed orders, signed approvals, EIP-712 domain construction, gasless transaction relayers.

Signature replay & EIP-712 detection

When this applies

• `ecrecover` and any signature verification path
• `permit` (EIP-2612, ERC-4494) implementations
• Meta-tx / gasless flows (ERC-2771, EIP-3074 / EIP-7702 wrapping)
• Signed off-chain orders (0x, Seaport, custom)
• Signed governance votes
• Validator-set / bridge signature aggregation (see [[bridge-specialist]])

Detection patterns

Missing nonce (CRITICAL)

bytes32 digest = keccak256(abi.encode(sender, amount));   // ← no nonce, infinitely replayable
require(ecrecover(digest, v, r, s) == sender);

Missing chainId in domain (CRITICAL — cross-chain replay)

EIP-712 domain MUST include `chainId`. Without it, signing on Ethereum replays on Optimism/Arbitrum/etc.

bytes32 domain = keccak256(abi.encode(EIP712_DOMAIN, name, version, /* no chainId */ , verifyingContract));

Hardcoded chainId / `_DOMAIN_SEPARATOR` cached without fork-detect (HIGH)

DOMAIN_SEPARATOR = _hashDomain(block.chainid);   // ← cached in constructor, breaks after fork

Re-compute when `block.chainid` differs.

Signature malleability (HIGH)

ECDSA accepts both `(r, s)` and `(r, n-s)` for valid signatures. If you use the digest as a uniqueness key, attacker can flip s and replay. Enforce `s ≤ secp256k1n/2` and `v ∈ {27, 28}`. Or use OpenZeppelin's `ECDSA.tryRecover` which already does this.

`ecrecover` returns address(0) on invalid sig — not reverted (HIGH)

address signer = ecrecover(digest, v, r, s);   // returns 0 on bad sig
require(roles[signer]);   // ← if roles[address(0)] is ever true (default mapping behavior), it bypasses

Always `require(signer != address(0))` after ecrecover, or use OZ ECDSA.

Replay across contracts (HIGH)

Missing `address(this)` / `verifyingContract` in the signed payload. Same admin sig usable on multiple deployments.

Front-running of permit (MEDIUM)

See [[mev-frontrunning]] §permit.

Approval-front-run via signed message (HIGH)

Off-chain signed orders where the maker can replay across fills if the order doesn't include `salt` + `nonce` + cancellation mechanism.

Permit2 confusion (HIGH)

Mixing Permit2's `SignatureTransfer` (one-shot) vs `AllowanceTransfer` (persistent). Read the contract's docs carefully.

Severity rubric

| Pattern | Severity | |---|---| | Missing nonce in signed payload | **Critical** | | Missing chainId — cross-chain replay possible | **Critical** | | `ecrecover` without `signer != address(0)` check | **High** | | Malleable signature accepted (no s-bound check) | **High** | | Cached DOMAIN_SEPARATOR without fork-aware re-compute | **High** | | Signed payload omits `verifyingContract` | **High** | | Order salt missing, no cancellation mechanism | **High** | | Off-by-one chainId for L2 chains (e.g. Polygon = 137 not 1) | **High** | | Permit gas-grief on revert reverts in batch | **Medium** |

Remediation patterns

• Use OZ `EIP712` base + `ECDSA.recover` — handles s-bound, malleability, zero-address.
• Include in every signed payload: `chainId`, `verifyingContract`, `nonce`, `deadline`, plus any operation-specific fields.
• Re-derive `DOMAIN_SEPARATOR` lazily when `block.chainid != cached_chainid`.
• Nonces: per-signer monotonic OR per-order salt + on-chain seen-bitmap.
• For ERC-1271 (contract signers), validate via `isValidSignature(bytes32, bytes)` returning the magic value.

False-positive notes

• Single-use bound to a specific consumed-event flag isn't strictly replayable — but still flag if the bound is fragile.
• Pure off-chain signatures never submitted on-chain don't have replay risk on chain, but watch for accidental reuse.

Related

• [[access-control]]
• [[bridge-specialist]] — validator set signatures
• [[mev-frontrunning]]