Skip to content
high Signatures SWC-121 CWE-294

Cross-Chain / Cross-Contract Signature Replay

SAFE-0045 Signatures Checked automatically by the scanner
1

What goes wrong

A signature valid on one chain or contract is replayed on another because the signed data omits chainId or the verifying contract address (no EIP-712 domain separator).

2

How to fix it

the pattern that is safe
bytes32 domain = keccak256(abi.encode(
    EIP712_DOMAIN, name, version, block.chainid, address(this)));
bytes32 h = keccak256(abi.encodePacked("\x19\x01", domain, structHash));
◆
Bind signatures to chainId + contract via EIP-712 domain.
3

Where this has happened

Largest recorded losses in the same failure class — related, not the same bug:

$586M · 2022 BNB Chain Token Hub Input validation · 2022 $326M · 2022 Wormhole Input validation · 2022 $197M · 2023 Euler Finance Input validation · 2023 $190M · 2022 Nomad Bridge Input validation · 2022
4

Related vulnerabilities in Signatures

SAFE-0044Signature Replay Attack critical · Signatures SAFE-0046Missing ecrecover Zero-Address / Malleability Check high · Signatures SAFE-0047Weak / Incorrect Signature Validation high · Signatures SAFE-0049Merkle Proof Validation Error high · Signatures SAFE-0112ecrecover Without Zero-Address Guard high · Signatures SAFE-0113Missing Nonce — Signature Replay high · Signatures SAFE-0048Hash Collision via abi.encodePacked with Dynamic Types medium · Signatures SAFE-0114Signature Missing Domain / chainid — Cross-Chain Replay medium · Signatures
← PreviousSignature Replay Attack
Check your own contract for this

The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0045 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.

Run the scanner See how it is attacked Read the docs