Zaros Part 1
Zaros
DeFiFoundry
60,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

`ECDSA.recover` throws an unexpected error if it fails to recover the signer.

qpzm

Summary

ECDSA.recover throws an unexpected error if it fails to recover the signer.

Vulnerability Details

ECDSA.recover throws an error if it fails to recover the signer.
https://github.com/OpenZeppelin/openzeppelin-contracts/blob/v5.0.2/contracts/utils/cryptography/ECDSA.sol#L156

Impact

Errors.InvalidOrderSigner is not reverted if a given signature is invalid, so ECDSA.recover fails to recover the signer.
https://github.com/Cyfrin/2024-07-zaros/blob/7439d79e627286ade431d4ea02805715e46ccf42/src/perpetuals/branches/SettlementBranch.sol#L269

Tools Used

Manual

Recommendations

Use tryRecover which returns address(0) if it fails to recover the signer.

- ctx.signer = ECDSA.recover(
+ (ctx.signer,,) = ECDSA.tryRecover
_hashTypedDataV4(ctx.structHash), ctx.offchainOrder.v, ctx.offchainOrder.r, ctx.offchainOrder.s
);
Updates

Lead Judging Commences

inallhonesty Lead Judge
12 months ago
inallhonesty Lead Judge 11 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.