OpenZeppelin Contracts is a library for secure smart contract development. The functions `ECDSA.recover` and `ECDSA.tryRecover` are vulnerable to a kind of signature malleability due to accepting EIP-2098 compact signatures in addition to the traditional 65 byte signature format. This is only an issue for the functions that take a single `bytes` argument, and not the functions that take `r, v, s` or `r, vs` as separate arguments. The potentially affected contracts are those that implement signature reuse or replay protection by marking the signature itself as used rather than the signed message or a nonce included in it. A user may take a signature that has already been submitted, submit it again in a different form, and bypass this protection. The issue has been patched in 4.7.3.
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published: 2022-08-14T00:05:09
Updated: 2024-08-03T09:51:59.403Z
Reserved: 2022-07-15T00:00:00
Link: CVE-2022-35961
Vulnrichment
No data.
NVD
Status : Modified
Published: 2022-08-15T11:21:39.937
Modified: 2024-11-21T07:12:03.497
Link: CVE-2022-35961
Redhat
No data.