Pre-auditThree days of senior audit time for $1,500, credited in full toward your Zealynx audit.3 audit days, credited toward your auditSee how →
L-18·

Contract wallets incompatible with `EIP-1271` signature verification

Not reportedoptionsleverageblack-scholes
TL;DR

The signature verification mechanism in IvSignerRecovery.sol relies exclusively on ECDSA recovery for validating signatures:

Severity
LOW
Method
MManual review
CAT.

The signature verification mechanism in IvSignerRecovery.sol relies exclusively on ECDSA recovery for validating signatures:

solidity
function _recoverSigner(
SplitSig memory sig,
uint256 iv,
IStrategy strategy,
uint256 maturityDate,
uint256 relativeStrike
) internal view returns (address) {
// Uses ECDSA recovery directly
return _digest(iv, strategy, maturityDate, relativeStrike).recover(sig.v, sig.r, sig.s);
}

This implementation only supports signatures from Externally Owned Accounts (EOAs) and lacks compatibility with EIP-1271 (Standard Signature Validation Method for Contracts). As a result, users with smart contract wallets (such as Gnosis Safe) cannot use the protocol's option buying functionality in the OperationalTreasury.buy() function, because their contract-based signatures cannot be verified by ECDSA.recover.

With the growing adoption of smart contract wallets for enhanced security features and multi-signature capabilities, this limitation unnecessarily restricts the protocol's user base.

Extend the signature verification logic to support EIP-1271. This typically involves checking if the signer's address corresponds to a contract. If it is a contract, call its isValidSignature function to confirm the signature's validity according to the contract's own logic.

02Section · Report provenance

Report provenance

Published by Pashov Audit Group, with Carlos (Bloqarl) participating as a contractor. The source report states that its fixes review was not fully completed; no final remediation disposition is recorded for this finding. Read the full report.

L-18