Signature Vulnerabilities

// VULNERABLE: no chain ID in signed data
bytes32 hash = keccak256(abi.encodePacked(user, amount, nonce));

// FIXED: include chain ID via EIP-712 domain separator
bytes32 public immutable DOMAIN_SEPARATOR;

constructor() {
    DOMAIN_SEPARATOR = keccak256(abi.encode(
        keccak256("EIP712Domain(string name,string version,uint256 chainId,address verifyingContract)"),
        keccak256(bytes("MyProtocol")),
        keccak256(bytes("1")),
        block.chainid,
        address(this)
    ));
}

mapping(address => uint256) public nonces;

function executeWithSignature(
    address user,
    uint256 amount,
    uint256 deadline,
    uint8 v, bytes32 r, bytes32 s
) external {
    if (block.timestamp > deadline) revert Expired();

    bytes32 structHash = keccak256(abi.encode(
        EXECUTE_TYPEHASH,
        user,
        amount,
        nonces[user]++,
        deadline
    ));

    bytes32 digest = keccak256(abi.encodePacked("\x19\x01", DOMAIN_SEPARATOR, structHash));

    address recovered = ecrecover(digest, v, r, s);
    if (recovered == address(0) || recovered != user) revert InvalidSignature();

    _execute(user, amount);
}

bytes32 public constant EXECUTE_TYPEHASH = keccak256(
    "Execute(address user,uint256 amount,uint256 nonce,uint256 deadline)"
);

function _hashTypedData(bytes32 structHash) internal view returns (bytes32) {
    return keccak256(abi.encodePacked("\x19\x01", DOMAIN_SEPARATOR, structHash));
}

// For complex types, hash inner structs first
bytes32 constant ORDER_TYPEHASH = keccak256(
    "Order(address maker,Asset makerAsset,Asset takerAsset,uint256 nonce,uint256 deadline)"
    "Asset(address token,uint256 amount)"
);

bytes32 constant ASSET_TYPEHASH = keccak256(
    "Asset(address token,uint256 amount)"
);

function hashOrder(Order memory order) internal pure returns (bytes32) {
    return keccak256(abi.encode(
        ORDER_TYPEHASH,
        order.maker,
        hashAsset(order.makerAsset),
        hashAsset(order.takerAsset),
        order.nonce,
        order.deadline
    ));
}

function hashAsset(Asset memory asset) internal pure returns (bytes32) {
    return keccak256(abi.encode(ASSET_TYPEHASH, asset.token, asset.amount));
}

// VULNERABLE: accepts both s values
address recovered = ecrecover(hash, v, r, s);

// FIXED: enforce low-s value (EIP-2 canonical form)
function _verifySignature(bytes32 hash, uint8 v, bytes32 r, bytes32 s)
    internal
    pure
    returns (address)
{
    // s must be in the lower half of the curve order
    if (uint256(s) > 0x7FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF5D576E7357A4501DDFE92F46681B20A0) {
        revert MalleableSignature();
    }

    address recovered = ecrecover(hash, v, r, s);
    if (recovered == address(0)) revert InvalidSignature();

    return recovered;
}

import {ECDSA} from "@openzeppelin/contracts/utils/cryptography/ECDSA.sol";
import {MessageHashUtils} from "@openzeppelin/contracts/utils/cryptography/MessageHashUtils.sol";

function verify(bytes32 hash, bytes memory signature) internal pure returns (address) {
    return ECDSA.recover(hash, signature); // handles malleability check
}

// VULNERABLE: doesn't check for address(0)
address signer = ecrecover(hash, v, r, s);
require(signer == expectedSigner); // passes if expectedSigner is address(0)

// FIXED: explicit zero check
address signer = ecrecover(hash, v, r, s);
if (signer == address(0)) revert InvalidSignature();
if (signer != expectedSigner) revert Unauthorized();

// VULNERABLE: permit reverts if already used
function depositWithPermit(
    uint256 amount, uint256 deadline,
    uint8 v, bytes32 r, bytes32 s
) external {
    token.permit(msg.sender, address(this), amount, deadline, v, r, s); // ← reverts if front-run
    token.safeTransferFrom(msg.sender, address(this), amount);
}

// FIXED: try/catch on permit, proceed if allowance already set
function depositWithPermit(
    uint256 amount, uint256 deadline,
    uint8 v, bytes32 r, bytes32 s
) external {
    try token.permit(msg.sender, address(this), amount, deadline, v, r, s) {} catch {}
    token.safeTransferFrom(msg.sender, address(this), amount);
}

mapping(address => uint256) public nonces;

// User must use nonce 0, then 1, then 2, etc.
// Cancel a nonce by calling with a no-op payload

// Nonces stored as bitmaps: nonce 256*wordPos + bitPos
mapping(address => mapping(uint256 => uint256)) public nonceBitmap;

function _useNonce(address owner, uint256 nonce) internal {
    uint256 wordPos = nonce >> 8;
    uint256 bitPos = nonce & 0xff;
    uint256 bit = 1 << bitPos;

    uint256 word = nonceBitmap[owner][wordPos];
    if (word & bit != 0) revert NonceAlreadyUsed();
    nonceBitmap[owner][wordPos] = word | bit;
}