skills.rest
Apegurus
ApegurusCOMMUNITY
Explore all skills by this author →
𝕏@ApegurusGitHub

signature-malleability

Detect signature malleability vulnerabilities in Solidity smart contracts using ECDSA.

1|1|Updated Feb 18, 2026
Search Tags:#security#vulnerability#smart contract#solidity#ecdsa#signature malleability
One-click install
npx skills add https://github.com/Apegurus/solidity-argus --skill signature-malleability
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: signature-malleability
Source: https://github.com/Apegurus/solidity-argus/tree/main/skills/vulnerability-patterns/signature-malleability
Command: npx skills add https://github.com/Apegurus/solidity-argus --skill signature-malleability

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill addresses vulnerabilities related to the improper handling of ECDSA signatures in smart contracts, which can lead to replay attacks or unauthorized actions.

Core Features & Use Cases

  • Detects insecure signature usage: Identifies contracts using raw ECDSA signatures for authorization or deduplication without proper normalization.
  • Analyzes signature verification: Checks for common pitfalls like direct ecrecover usage without nonce or domain separation, and lack of s-value range checks.
  • Use Case: Auditing a DeFi protocol that uses signatures to authorize critical state changes, ensuring that attackers cannot reuse or manipulate valid signatures.

Quick Start

Analyze the 'VaultContract.sol' for signature malleability vulnerabilities.

Frequently Asked Questions about signature-malleability

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
What is signature malleability in Solidity smart contracts?▼

Signature malleability in Solidity is a vulnerability where attackers manipulate ECDSA signatures by altering the s-value to create a second valid signature, enabling replay attacks or unauthorized actions.

How do I detect ECDSA signature malleability vulnerabilities in my smart contract?▼

You can detect ECDSA signature malleability by analyzing Solidity smart contract code to identify raw ecrecover usage without nonce or domain separation, and check for missing s-value range normalization to ensure signature integrity.

Why does raw ecrecover usage create a vulnerability in DeFi protocols?▼

Raw ecrecover usage creates a vulnerability because it lacks s-value normalization and domain separation, allowing attackers to manipulate valid ECDSA signatures to reuse authorization for critical state changes.

How do I fix s-value normalization issues in Solidity ECDSA verification?▼

Fix s-value normalization issues by enforcing signature integrity through s-value range checks and adding nonce or domain separation, following remediation guidance to prevent replay attacks in smart contract authorization.

Can I use this to audit a DeFi protocol that uses signatures for authorization?▼

Yes, you can audit a DeFi protocol using signatures for authorization by analyzing Solidity smart contracts for insecure ECDSA patterns, ensuring attackers cannot reuse or manipulate valid signatures to trigger critical state changes.

Related Skills

Explore More Software Engineering Skills→
ApegurusApegurus
1

unsecure-signatures

Detect unsecure ECDSA signature implementations in Solidity smart contracts.

Community
Intermediate
auth0auth0
40

auth0-dpop

Bind access tokens to a client-held key pair with DPoP.

Official
Advanced
Ramprasad4121Ramprasad4121
1

security-auditor

Audit Solidity smart contracts using Slither, Aderyn, and the Map-Hunt-Attack methodology.

Community
Advanced
ccashwellccashwell
120

signature-vulnerabilities

Identify and mitigate signature vulnerabilities in Solidity smart contracts.

Community
Advanced