Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Signed Transaction Replay-ability #16

Open
AndyHydro opened this issue Oct 30, 2018 · 0 comments
Open

Signed Transaction Replay-ability #16

AndyHydro opened this issue Oct 30, 2018 · 0 comments

Comments

@AndyHydro
Copy link

As it currently stands, the standard signing procedure is byte(0x19), byte(0), this, nonce[identityOwner(identity)], identity + other data to be signed. Due to all of the registries being deployed at the same contract address, this allows for a signed transaction to be replayed on a different network. The downsides of this are small, but could still be quite annoying/negative for a user.

For example, if I were to have changed my owner on my 50th transaction on Rinkeby, an attacker could wait until my mainnet identity owner at the same address had 49 transactions and could then replay the transaction to force me to swap owners. If I had lost ownership of the new address this could render my identity unusable.

I understand the cases where this can come into play are pretty niche, but I would like to propose an update to the signing methods to byte(0x19), byte(0), this, NETWORK_ID, nonce[identityOwner(identity)], identity + other data to be signed. Under this signing logic, the NEWTORK_ID would be hard coded into each deployed smart contract as 1 (Mainnet), 3 (Ropsten), 4 (Rinkeby) and 42 (Kovan).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant