ECDSA signature malleability in OpenZeppelin Contracts

OpenZeppelin Contracts' ECDSA.recover and ECDSA.tryRecover functions accept both traditional 65-byte signatures and EIP-2098 compact signatures (64 bytes). This dual-format acceptance introduces signature malleability: an attacker can convert a valid signature into a different form while preserving recoverability. The vulnerability affects contracts that mark the signature itself as used, rather than the signed message or a nonce, for replay protection [1].

An attacker who has observed a submitted transaction can take the original signature, convert it to the alternative format, and resubmit the same message with a different signature. No authentication or network position is required beyond visibility of a valid signature. The functions that take separate r, v, s or r, vs parameters are not affected [1].

Successful exploitation allows bypassing replay protection, enabling double-spending or unauthorized repeats of signed actions. The impact depends on the contract's use of signatures; for example, token transfers or voting systems could be compromised.

The issue is patched in OpenZeppelin Contracts v4.7.3. The fix removes support for compact signatures in the bytes-based functions [2][3]. Users should upgrade to v4.7.3 or later and ensure that any use of ECDSA.recover or ECDSA.tryRecover with a single bytes argument does not rely solely on signature uniqueness for replay protection [4].