Sparkn

Summary

Use native account abstraction over ecrecover for validation.

Vulnerability Details

By reviewing the documentation, it is understood that the contracts should be deployed to any EVM-compatible chains. If the contracts are to be deployed to zksync, we need to take into account additional security concerns. Let's delve into the "Security and Best Practices" guidelines provided by zksync.
https://era.zksync.io/docs/dev/building-on-zksync/best-practices.html#use-native-account-abstraction-over-ecrecover-for-validation

Use zkSync Era's native account abstraction support for signature validation instead of this function.
We recommend not relying on the fact that an account has an ECDSA private key, since the account may be governed by multisig and use another signature scheme.

Impact

If an account is managed by a multi-signature setup or employs alternative signature schemes, it could potentially introduce security vulnerabilities.

Tools Used

vscode

Recommendations

If the contract is deployed on zksync, it is recommended to use zkSync Era's native account abstraction support for signature validation instead of this function.