Sparkn

Summary

Vulnerability Details

According to the description in the document, the contracts are supposed to be deployed to any EVM-compatible chains.The zkSync Era is the first EVM-compatible chain to implement native account abstraction. The accounts in the zkSync Era can initiate transactions like Externally Owned Accounts (EOAs), but they can also implement any logic within them, like smart contracts. This feature is known as “Account Abstraction” (AA). Therefore, when performing signature verification, one should not rely on the fact that the account has an ECDSA private key, as the account may be managed by multi-signatures and use other signature schemes.
https://era.zksync.io/docs/dev/building-on-zksync/best-practices.html#use-native-account-abstraction-over-ecrecover-for-validation

Impact

Some accounts using different signatures might be unusable

Tools Used

Vscode

Recommendations

It is recommended to use the native account abstraction support of the zkSync Era to replace the ecrecover function for signature verification