Root + Impact

Description

• Each multisig transaction must be uniquely identifiable, even when calldata and targets are reused, so that signer confirmations apply only to the intended action.

• Transaction identity is derived without a nonce or domain separator, allowing multiple transactions with identical (target, value, data) to share the same hash.

Risk

Likelihood:

• Governance frequently reuses calldata (e.g., repeated transfer() calls).

Treasury operations often repeat the same actions over time.

Impact:

• Confirmations may unintentionally apply to later transactions.

Signer intent is violated, weakening multisig trust guarantees.

Proof of Concept

• Without a nonce, the contract cannot distinguish between logically separate actions that look identical at the calldata level.

Recommended Mitigation

• Guarantees transaction uniqueness.

Prevents replay or confirmation reuse.

• Matches industry-standard multisig designs (Gnosis Safe–style domain separation).