Skip to content
high Signatures SWC-117 CWE-347

Weak / Incorrect Signature Validation

SAFE-0047 Signatures Checked automatically by the scanner
1

What goes wrong

Signature verification mis-orders parameters, hashes the wrong data, accepts arbitrary signers, or does not validate that the recovered signer holds the required role.

2

How to fix it

the pattern that is safe
bytes32 h = keccak256(abi.encode(a, b));        // unambiguous encoding
require(authorized[ECDSA.recover(h, sig)], "unauthorized");
◆
Use abi.encode + role check for signed actions.
3

Where this has happened

Largest recorded losses in the same failure class — related, not the same bug:

$586M · 2022 BNB Chain Token Hub Input validation · 2022 $326M · 2022 Wormhole Input validation · 2022 $197M · 2023 Euler Finance Input validation · 2023 $190M · 2022 Nomad Bridge Input validation · 2022
4

Related vulnerabilities in Signatures

SAFE-0044Signature Replay Attack critical · Signatures SAFE-0045Cross-Chain / Cross-Contract Signature Replay high · Signatures SAFE-0046Missing ecrecover Zero-Address / Malleability Check high · Signatures SAFE-0049Merkle Proof Validation Error high · Signatures SAFE-0112ecrecover Without Zero-Address Guard high · Signatures SAFE-0113Missing Nonce — Signature Replay high · Signatures SAFE-0048Hash Collision via abi.encodePacked with Dynamic Types medium · Signatures SAFE-0114Signature Missing Domain / chainid — Cross-Chain Replay medium · Signatures
← PreviousMissing ecrecover Zero-Address / Malleability Check
Check your own contract for this

The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0047 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.

Run the scanner See how it is attacked Read the docs