Contract wallets incompatible with `EIP-1271` signature verification
The signature verification mechanism in IvSignerRecovery.sol relies exclusively on ECDSA recovery for validating signatures:
The signature verification mechanism in IvSignerRecovery.sol relies exclusively on ECDSA recovery for validating signatures:
function _recoverSigner(SplitSig memory sig,uint256 iv,IStrategy strategy,uint256 maturityDate,uint256 relativeStrike) internal view returns (address) {// Uses ECDSA recovery directlyreturn _digest(iv, strategy, maturityDate, relativeStrike).recover(sig.v, sig.r, sig.s);}
This implementation only supports signatures from Externally Owned Accounts (EOAs) and lacks compatibility with EIP-1271 (Standard Signature Validation Method for Contracts). As a result, users with smart contract wallets (such as Gnosis Safe) cannot use the protocol's option buying functionality in the OperationalTreasury.buy() function, because their contract-based signatures cannot be verified by ECDSA.recover.
With the growing adoption of smart contract wallets for enhanced security features and multi-signature capabilities, this limitation unnecessarily restricts the protocol's user base.
Extend the signature verification logic to support EIP-1271. This typically involves checking if the signer's address corresponds to a contract. If it is a contract, call its isValidSignature function to confirm the signature's validity according to the contract's own logic.
Report provenance
Published by Pashov Audit Group, with Carlos (Bloqarl) participating as a contractor. The source report states that its fixes review was not fully completed; no final remediation disposition is recorded for this finding. Read the full report.