140.md

CRYP70

medium

Possible cross chain replay attacks when attempting to validate signer

Summary

The _validateSigner() function is used when calling resolveQueuedTrades() and unlockOptions() however, the chain id is not specified when attempting to validate the signature.

Vulnerability Detail

There is no chain id in the signed data.

Impact

If a user calls a function which uses the _validateSigner() function while using the incorrect network, the attacker can replay the act on the correct chain to cause unexpected results.

Code Snippet

https://github.com/sherlock-audit/2022-11-buffer/blob/main/contracts/contracts/core/BufferRouter.sol#L267

Tool used

Manual Review

Recommendation

Consider including block.chainId in the hashed content.