missing-protection-signature-replay

Prevent signature replay attacks in Solidity smart contracts by analyzing ECDSA verification logic to ensure signed message hashes include nonces, contract addresses, and chain IDs, while tracking processed signatures to block unauthorized re-execution.

A signature replay vulnerability in ECDSA authorization occurs when a smart contract accepts the same signature multiple times or across different contexts due to insufficient validation, allowing malicious actors to re-execute unauthorized actions.

Audit smart contracts for cross-chain signature replay risks by checking whether signed message hashes incorporate chain IDs and contract addresses, verifying that the same ECDSA signature cannot be reused across different chains or contracts.

Your contract needs nonces to secure ECDSA signature verification if it lacks mechanisms to track processed signatures, ensuring that authorization signatures cannot be replayed maliciously across same-contract, cross-contract, or cross-chain scenarios.

Relying solely on ECDSA signature verification for authorization is limited because without incorporating nonces, contract addresses, and chain IDs into the signed message hash, signatures remain vulnerable to replay attacks across various execution contexts.