# Cross-Chain Signature Replay Attack

VerifyingSingletonPaymaster.getHash omits chainId, so a signed UserOperation can be replayed on another chain to drain paymaster sponsorship.

- Payout: Contest reward
- Severity: medium
- Program: Biconomy
- Credited: gogo
- Disclosed: 2023-03-03
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-01-biconomy-findings/issues/466
- Library page: https://bugbountylibrary.com/r/c4%3A2023-01-biconomy%3AM-03
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:signature-replay

**Target:** ERC-4337 VerifyingSingletonPaymaster contract getHash
**Root cause:** getHash() encodes UserOperation fields without block.chainid (and without address(this)/paymaster nonce), so the paymaster's verifyingSigner signature is valid across chains and repeatable per wallet.
**Steps:**
1. Read VerifyingSingletonPaymaster.sol getHash(): keccak256(abi.encode(sender, nonce, initCode, callData, gas fields, fees)) — no chainid.
2. Observe verifyingSigner signs this hash off-chain; same signer used on all deployed chains.
3. Capture a valid signed UserOperation on chain A.
4. Submit the identical UserOperation to the paymaster on chain B (same account address) — signature verifies.
5. Repeat submissions since no per-wallet paymaster nonce is tracked, consuming paymaster sponsorship funds.
**How found:** Code review against EIP-4337 guidance that signatures must depend on chainid; noticed getHash omitted block.chainid while hashing UserOperation fields.
**Exploitation:** Attacker obtains a paymaster-signed UserOperation (from mempool or own sponsored tx) and replays it on another chain or repeatedly against the same paymaster, forcing the paymaster to sponsor gas for operations it never approved, draining its deposit.
**Escalation:** Warden notes replay is limited to paymaster harm; Biconomy adds that missing address(this) and per-wallet paymaster nonces allow same-chain replay too.
**Insight:** When auditing ERC-4337 paymasters, check the signed hash includes chainid, address(this), and a paymaster-side per-wallet nonce — omitting any enables replay of sponsored UserOps.