Why Signature Replay Attacks Are an Epidemic

Signature replay attacks are not edge cases; they are a systemic vulnerability in how blockchains verify off-chain messages. The core failure is that a signature valid on one chain is often valid on another, allowing attackers to replay approvals.

The root cause is non-unique message encoding. Protocols like LayerZero and Wormhole use generalized message passing, but if the signing context isn't cryptographically bound to a specific destination chain, a signed permit for Ethereum can be replayed on Polygon.

This is not theoretical. The 2022 Nomad Bridge hack, a $190M loss, was a mass replay event. Similar vulnerabilities have been exploited in Across Protocol and Stargate integrations, where user signatures for a source chain transaction were replayed on the destination.

The industry standard EIP-712 attempts to solve this with domain separation, but inconsistent implementation across wallets and chains creates gaps. The epidemic persists because security is a fragmented afterthought in the race for interoperability.

Ambiguous message encoding is the root cause. A signed message's hash depends on its serialization (e.g., ABI encoding, RLP). Without a standard, a signature valid on one chain is valid on another, enabling replay.

The EIP-712 standard was a partial solution for wallets, but cross-chain applications like Across Protocol and LayerZero handle custom, complex payloads. Their ad-hoc encoding creates attack surfaces absent in simple token transfers.

Counter-intuitively, more security audits increase risk. Each reviewed protocol creates a unique, non-standard signing scheme. This fragments the security landscape, making systemic review impossible and guaranteeing novel flaws in each implementation.

Evidence: The Poly Network hack exploited encoding mismatches. The attacker replayed a signature from one chain's governance to another, stealing $611 million. This pattern repeats in smaller bridge exploits weekly.

Signature replay is a state problem. A signed message is valid for any chain state where its logic executes. Without a state-binding mechanism, a signature for a swap on Polygon can be replayed on Arbitrum.

EIP-712 structured data mitigates but does not solve replay. It defines a domain separator with chainId, but this is a static check. A signature remains valid for the entire state history of that chain, enabling cross-contract and cross-function replays within the same network.

The industry standard is insufficient. Major protocols like Uniswap and OpenSea rely on EIP-712, which prevents cross-chain replay but not sophisticated in-chain replay attacks. This creates systemic risk for intent-based systems like UniswapX and CowSwap.

Evidence: The $2M Indexed Finance exploit. An attacker replayed a governance signature to drain funds, proving that domain separation alone is not defense. The signature was valid, but its re-execution in a new context broke the protocol's state machine.