Mastering Blockchain Programming with Solidity

Signature replay attacks

There are some cases when a user signs some data off-chain and the data is given to some other authorized user who will submit the signed data on the contract. This process allows users to perform transactions even when off-chain and later, the confirmation or trade is updated on-chain. For example, in projects such as 0xProject, where trades are matched off-chain by signing the order data and later on, actual trade is updated on-chain.

Let's look at an example:

import "openzeppelin-solidity/contracts/cryptography/ECDSA.sol";contract ReplayAttack {    using ECDSA for bytes32;    //Bad Practice    function submitRequest(        address _signer,        address _target,        uint _param1,        uint _param2,        bytes memory _signature    )        public onlyAuthorized ...