Description:
The zkSync era documentation suggests using SignatureChecker
instead of ECDSA
for signature validation. This advice is grounded in the distinction between ECDSA signatures and contract signatures. Unlike ECDSA signatures, contract signatures are revocable, meaning their validity can change over time. For instance, a signature might be considered valid at block N but invalid at block N+1, or vice versa.
Impact:
Accounts may utilize different signature schemes, making ECDSA.recover
ineffective for accurate signature validation. This limitation could result in failed validations and potential security risks.
Recommended Mitigation:
To mitigate this issue, incorporate a isValidSignature
function into your smart contract. This function should utilize SignatureChecker
from the OpenZeppelin contracts library, shifting away from the conventional use of ECDSA.recover
.
Here's an illustrative implementation:
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.