# Recovery transaction can be replayed after a cancellation

Ambire wallet recovery signatures could be replayed after cancellation because nonces only increment on execution, letting an attacker reinstate a canceled recovery.

- Payout: Audit contest
- Severity: medium
- Program: Ambire
- Found by: adriro
- Disclosed: 2023-08-04
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2023-05-ambire#m-03
- Library page: https://bugbountylibrary.com/r/c4%3A2023-05-ambire%3AM-03
- Tags: area:web3 domain:web3 impact:ato impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm technique:source-review vuln:access-control vuln:business-logic vuln:signature-replay

**Target:** Ambire wallet recovery mechanism (execute() with SIGMODE_RECOVER/SIGMODE_CANCEL)
**Root cause:** Nonces are only incremented when a bundle executes, so a cancellation that clears scheduledRecoveries does not advance the nonce, leaving the original recovery signature valid for replay.
**Steps:**
1. Initiate recovery via a transaction signed with `SIGMODE_RECOVER`, enqueuing the bundle after the timelock.
2. Cancel the procedure with a signed call using `SIGMODE_CANCEL`, which deletes `scheduledRecoveries[hash]`.
3. Replay the original step-1 recovery transaction; since the nonce is unchanged, it re-enqueues the recovery.
**How found:** Observed that nonces only increment on bundle execution, so cancellation leaves the nonce static, making prior recovery signatures replayable.
**Exploitation:** An attacker who observed the original recovery bundle replays it after the legitimate owner cancels, reinstating the recovery and eventually taking over the wallet once the timelock passes.
**Insight:** In signature-scheme designs, check every state-clearing path (cancel, revoke, delete) for nonce advancement; any path that removes state without bumping the nonce leaves old signatures replayable.