signature-malleability

Name: signature-malleability
Availability: InStock
Author: Apeguru

Detect signature malleability vulnerabilities in Solidity smart contracts using ECDSA.

1|1|Updated Feb 18, 2026

Search Tags:#security #vulnerability #smart contract #solidity #ecdsa #signature malleability

Ready to run

npx skills add https://github.com/Apegurus/solidity-argus --skill signature-malleability

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: signature-malleability
Source: https://github.com/Apegurus/solidity-argus/tree/main/skills/vulnerability-patterns/signature-malleability
Command: npx skills add https://github.com/Apegurus/solidity-argus --skill signature-malleability

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill addresses vulnerabilities related to the improper handling of ECDSA signatures in smart contracts, which can lead to replay attacks or unauthorized actions.

Core Features & Use Cases

Detects insecure signature usage: Identifies contracts using raw ECDSA signatures for authorization or deduplication without proper normalization.
Analyzes signature verification: Checks for common pitfalls like direct ecrecover usage without nonce or domain separation, and lack of s-value range checks.
Use Case: Auditing a DeFi protocol that uses signatures to authorize critical state changes, ensuring that attackers cannot reuse or manipulate valid signatures.

Quick Start

Analyze the 'VaultContract.sol' for signature malleability vulnerabilities.

Frequently Asked Questions about signature-malleability

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

What is signature malleability in Solidity smart contracts?▼

Signature malleability in Solidity is a vulnerability where attackers manipulate ECDSA signatures by altering the s-value to create a second valid signature, enabling replay attacks or unauthorized actions.

How do I detect ECDSA signature malleability vulnerabilities in my smart contract?▼

You can detect ECDSA signature malleability by analyzing Solidity smart contract code to identify raw ecrecover usage without nonce or domain separation, and check for missing s-value range normalization to ensure signature integrity.

Why does raw ecrecover usage create a vulnerability in DeFi protocols?▼

Raw ecrecover usage creates a vulnerability because it lacks s-value normalization and domain separation, allowing attackers to manipulate valid ECDSA signatures to reuse authorization for critical state changes.

How do I fix s-value normalization issues in Solidity ECDSA verification?▼

Fix s-value normalization issues by enforcing signature integrity through s-value range checks and adding nonce or domain separation, following remediation guidance to prevent replay attacks in smart contract authorization.

Can I use this to audit a DeFi protocol that uses signatures for authorization?▼

Yes, you can audit a DeFi protocol using signatures for authorization by analyzing Solidity smart contracts for insecure ECDSA patterns, ensuring attackers cannot reuse or manipulate valid signatures to trigger critical state changes.