Overview

This skill provides a structured framework to analyze on-chain signature flows, with emphasis on rounding issues and exploitation patterns. It helps auditors decide when to apply an on-chain signatures review and what issues to look for.

How This Skill Works

The checklist guides you through sections like When to Use and Examples of issues, then drives Additional Analysis to surface issues beyond common patterns. It stresses applying security expertise to identify signature-related risks in smart contracts and verifications on-chain.

When to Use It

• Auditing a smart contract that accepts signed approvals or meta-transactions on-chain.
• Reviewing a DeFi protocol that validates user actions via on-chain signatures.
• Designing or auditing multi-signature wallets and nonce/replay protections.
• Assessing on-chain signature flow in relayed or cross-chain messaging.
• Investigating potential signature replay, rounding, or malleability issues in on-chain verification.

Quick Start

1. Step 1: Identify all on-chain signature verifications in the target contract.
2. Step 2: Review hashing, domain separation, and the signature recovery path for correctness.
3. Step 3: Apply best practices and run tests to catch rounding, replay, and malleability issues.

Best Practices

• Use standard signature schemes (ECDSA/Secp256k1) with explicit domain separation and clear hashing.
• Validate message hashing end-to-end and implement robust nonce/replay protections.
• Check for signature malleability (s-value normalization, proper v handling) and avoid malleable recoveries.
• Keep signature verification logic isolated in small, auditable functions with minimal state.
• Create regression tests with known edge cases (and fuzzing) to catch rounding and arithmetic-related issues.

Example Use Cases

• A meta-transaction system where users sign actions that relayers submit on-chain.
• A permit-style function where on-chain verification controls token transfers.
• Governance contracts validating proposals via on-chain signatures from token holders.
• Relayer-based bridges that require signed attestations to authorize message relays.
• Cross-chain messaging patterns that verify on-chain signatures to ensure message integrity.

Frequently Asked Questions