DeFi Security · Vulnerability class
Signature and replay
A signed message or proof is accepted in a context it was not meant for, or more than once.
The concept
Signatures need domain separation, nonces and expiry. Without them a valid message can be replayed on another chain, contract or time.
Defensive lessons
- Bind signatures to chain, contract and purpose.
- Use nonces and expiry.
- Reject duplicates.
Stored incidents
No stored incident is classified here yet. We will not add one on the strength of a title.