Summary

K1Validator is vulnerable to signature malleability, which allows an attacker to produce multiple valid signatures for the same message. This can cause replay attacks if the system does not properly handle nonces or other mechanisms to ensure the uniqueness of each signature.

Vulnerability Details

The K1Validator contract relies on Solady's SignatureCheckerLib to verify that the signature provided is valid. However, the SignatureCheckerLib does not check if a signature is non-malleable. This means that an attacker can create another valid signature for the same message, potentially bypassing restrictions that rely on the uniqueness of the signature.

ValidateUserOp:

isValidSignatureWithSender:

Impact

An attacker can create multiple valid signatures for the same message and then bypassing restrictions that rely on the uniqueness of the signature and leading to replay attacks.

Tools Used

Manual review

Recommendations

Add a check to ensure that the s value of the signature is within the valid bounds to avoid signature malleability.
Another way could be to either use the ECSDA lib from Openzeppelin which checks signature malleability or implement a nonce system.