160.md

bin2chen

medium

_validateSigner() cross-chain re-use signature risk

Summary

_validateSigner() not add chainId to signature have re-use signature risk if There is a need for subsequent deployment in other chains.

Vulnerability Detail

_validateSigner() without chainId

    function _validateSigner(
        uint256 timestamp,
        address asset,
        uint256 price,
        bytes memory signature
    ) internal view returns (bool) {
        bytes32 digest = ECDSA.toEthSignedMessageHash(
            keccak256(abi.encodePacked(timestamp, asset, price)) //***@audit without chainId***/
        );
        address recoveredSigner = ECDSA.recover(digest, signature);
        return recoveredSigner == publisher;
    }

Impact

cross-chain re-use signature risk

Code Snippet

https://github.com/sherlock-audit/2022-11-buffer/blob/main/contracts/contracts/core/BufferRouter.sol#L260-L271

Tool used

Manual Review

Recommendation

signature with chainid