Repository navigation
Conversation
…rification
### Summary of Changes
Addresses signature malleability in `src/Scribe.sol` during feed registration (`_lift`) by enforcing canonical low-s bounds on ECDSA signatures[cite: 38, 39].
---
### Vulnerability Analysis
- In standard ECDSA on secp256k1, `(r, s)` and `(r, secp256k1n - s)` are both mathematically valid for the same signer.
- Without bounding `s <= secp256k1n / 2`, a malicious party or relay can malleate a valid feed registration signature into an alternative valid byte representation without invalidating `ecrecover`.
- While `_lift` prevents duplicate registrations of the same feed address, non-canonical signatures break byte-uniqueness invariants and violate standard cryptographic safety guidelines[cite: 39].
---
### Remediation
- Added canonical low-s assertion in `_lift`:
```solidity
require(
ecdsaData.s <= 0x7FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF5D576E7357A4501DDFE92F46681B20A0,
"Scribe: signature s not canonical"
);
Member
|
Risk accepted. Next time, please open an issue first to discuss. For security relevant issues, send an email to |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary of Changes
Addresses signature malleability in
src/Scribe.solduring feed registration (_lift) by enforcing canonical low-s bounds on ECDSA signatures[cite: 38, 39].Vulnerability Analysis
(r, s)and(r, secp256k1n - s)are both mathematically valid for the same signer.s <= secp256k1n / 2, a malicious party or relay can malleate a valid feed registration signature into an alternative valid byte representation without invalidatingecrecover._liftprevents duplicate registrations of the same feed address, non-canonical signatures break byte-uniqueness invariants and violate standard cryptographic safety guidelines[cite: 39].Remediation
_lift: ```solidity require( ecdsaData.s <= 0x7FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF5D576E7357A4501DDFE92F46681B20A0, "Scribe: signature s not canonical" );Any non-canonical high-s signature now reverts immediately[cite: 39].
Verification
Compiled with solc 0.8.16: clean compilation with zero warnings. Verified with valid low-s and inverted high-s signature test vectors.