◇ Stage 1 · Briefing
Signature replay (recurring class)
Permit & meta-transaction systemsA signed approval that binds neither a nonce nor a chain id is a blank cheque: it stays valid forever, and it is valid on every EVM chain at once. This class has repeatedly drained permit-based (EIP-2612) and meta-transaction relayers — anyone who observes one valid signature can submit it again, and again, and on a second chain. The fix is the EIP-712 discipline this lab teaches: bind a nonce, block.chainid, and the contract address into the digest, and consume the nonce on use.
Date2020 – present
ImpactTens of $M across incidents
DurationReplayable until patched
Attack classWallet security
Timeline
EIP-712 (2018)Typed-data signing standardises domain separators — including chainId and verifying contract.
EIP-2612 (2020)gasless "permit" approvals spread; implementations that skip nonce/chainId binding become replayable.
OngoingRelayers and bridges are repeatedly hit by replayed signatures across transactions and chains.
Stage 1 of 5