Raw ecrecover accepts both the low-s and high-s form of a signature, so a second, different-looking signature exists for the same message. Systems that use the signature bytes as a uniqueness key (e.g. to prevent replay) can be bypassed with the malleated variant.
// usedSig[keccak256(sig)] = true; // dedup by raw bytes // attacker flips s -> (n - s) and v, producing sig2 != sig for same msg. // keccak256(sig2) is new -> replay guard bypassed.
require(uint256(s) <= 0x7FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF5D576E7357A4501DDFE92F46681B20A0, "high-s");
require(v == 27 || v == 28, "bad v");
// or just use OpenZeppelin ECDSA.recover
Largest recorded losses in the same failure class — related, not the same bug:
The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0115 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.