Skip to content

ecrecover Without Zero-Address Guard

SAFE-0112 Signatures Checked automatically by the scanner
1

What goes wrong

ecrecover returns address(0) for a malformed signature. If the recovered signer is used for authorization without a require(signer != address(0)) check, an attacker submits garbage bytes and, where the expected signer field is uninitialised (also 0), passes the check.

2

The vulnerable pattern

proof of concept — how it is exploited
// mapping(address => bool) authorized; // default false, but...
// if code checks `if (ecrecover(...) == owner)` and owner slot is 0 in a
// fresh/clone proxy, a bogus signature recovers to 0 == owner -> bypass.
3

How to fix it

the pattern that is safe
address signer = ecrecover(digest, v, r, s);
require(signer != address(0) && signer == expected, "bad sig");
// prefer ECDSA.recover (OpenZeppelin), which reverts on 0 and high-s
Always reject the zero address from ecrecover.
Check your own contract for this

The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0112 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.

Run the scanner See how it is attacked Read the docs