# cancelSig will not completely cancel signatures due to malleability vulnerabilities

Nouns DAO cancelSig only blacklists one ECDSA signature form; a malleated variant of the same signature still passes proposeBySigs, letting a proposer revive a cancelled signature.

- Payout: Contest reward
- Severity: medium
- Program: Nouns DAO
- Credited: kutugu
- Disclosed: 2023-07-31
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-07-nounsdao-findings/issues/198
- Library page: https://bugbountylibrary.com/r/c4%3A2023-07-nounsdao%3AM-01
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:auth-bypass vuln:signature-replay

**Target:** NounsDAOV3Proposals cancelSig / proposeBySigs signature validation
**Root cause:** cancelSig stores the raw signature bytes as cancelled, but ECDSA signatures are malleable: flipping s to n-s (and adjusting v) yields a different byte string that recovers the same signer, so the cancelled-hash check misses it.
**Steps:**
1. Signer signs a proposal via signProposal and calls `dao.cancelSig(signature)`; the raw bytes are recorded as cancelled.
2. Proposer submits `proposeBySigs` with the original signature -> reverts with `SignatureIsCancelled`.
3. Proposer converts the signature to 2098/compact form via `to2098Format(signature)` (flip s parity bit / v), producing different bytes for the same signer.
4. Proposer resubmits `proposeBySigs` with the malleated signature; the cancelled check passes and the proposal is created (state Updatable).
**How found:** Warden noted the project used an OpenZeppelin ECDSA version affected by the known signature-malleability issue (OZ PR #3610) and that cancelSig keys cancellation on raw signature bytes, then tested a malleated variant against proposeBySigs.
**Exploitation:** A malicious proposer who collected a signer's signature can, after the signer cancels it, malleate the signature bytes and still create the proposal on-chain; the proposal then proceeds through the normal lifecycle (quorum/voting), so impact is limited to reviving a cancelled proposal rather than direct fund loss.
**Insight:** When a contract blacklists signatures by raw bytes (cancelSig/used-signature mapping), check whether the ECDSA lib normalizes s; if not, the (r, n-s, v') twin bypasses the blacklist. Test by re-encoding the same signature into compact/2098 form.