-
Notifications
You must be signed in to change notification settings - Fork 137
SIWE Doesn't properly handle Multisig Wallet Signatures #216
Copy link
Copy link
Open
Description
Description
When using SIWE with multisig wallets (like Gnosis Safe), the signature verification fails with an invalid raw signature length error. This occurs because multisig signatures are longer than standard EOA signatures (65 bytes)
Current Behavior
- When a user signs in with a multisig wallet, the signature length is >132 characters (including '0x' prefix)
- The SIWE library attempts to verify
- This fails with:
TypeError: invalid raw signature length (argument="signature", value="0x...", code=INVALID_ARGUMENT) - However, the verification still succeeds
Expected Behavior
The SIWE library should:
- Detect multisig signatures (length > 132 characters)
- Handle them appropriately without throwing signature length errors
Steps to Reproduce
- Set up a SIWE implementation
- Use a multisig wallet (e.g., Gnosis Safe) to sign in
- The signature will be longer than a standard EOA signature
- Attempt to verify the signature using SIWE's
verify()method
Code Example
const siweMessage = new SiweMessage(message);
const fields = await siweMessage.verify(
{ signature }, // multisig signature (>132 chars)
{ provider }
);
// Throws: TypeError: invalid raw signature lengthEnvironment
- SIWE version: 3.0.0
- Node.js version: 20.18.2
PS
- The current behavior is confusing because the verification "succeeds" despite the error
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
No labels