Root + Impact

Description

• Each multisig transaction is expected to be uniquely identified so signer confirmations apply only to the intended action.

Transaction identity is derived without a nonce or domain separator, allowing distinct transactions with identical parameters to share the same identity and confirmations.

Risk

Likelihood:

• Occurs when governance submits repeated transactions with identical calldata

Common during treasury transfers or repeated administrative actions

Impact:

• Signer confirmations may unintentionally authorize unintended executions

Violates signer intent and multisig safety assumptions

Proof of Concept

Recommended Mitigation

• Bind transaction identity to a unique nonce or transaction ID.