Skip to content

Signed Transaction Replay-ability  #16

@AndyHydro

Description

@AndyHydro

As it currently stands, the standard signing procedure is byte(0x19), byte(0), this, nonce[identityOwner(identity)], identity + other data to be signed. Due to all of the registries being deployed at the same contract address, this allows for a signed transaction to be replayed on a different network. The downsides of this are small, but could still be quite annoying/negative for a user.

For example, if I were to have changed my owner on my 50th transaction on Rinkeby, an attacker could wait until my mainnet identity owner at the same address had 49 transactions and could then replay the transaction to force me to swap owners. If I had lost ownership of the new address this could render my identity unusable.

I understand the cases where this can come into play are pretty niche, but I would like to propose an update to the signing methods to byte(0x19), byte(0), this, NETWORK_ID, nonce[identityOwner(identity)], identity + other data to be signed. Under this signing logic, the NEWTORK_ID would be hard coded into each deployed smart contract as 1 (Mainnet), 3 (Ropsten), 4 (Rinkeby) and 42 (Kovan).

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions