# Missing signature duplication check in the submitCheckpoint function

Recall's submitCheckpoint lacks signatory uniqueness checks, letting one validator duplicate signatures to inflate weight and pass quorum alone.

- Payout: Contest reward
- Severity: high
- Program: Recall
- Credited: shaflow2
- Disclosed: 2026-03-13
- Write-up quality: 7/10
- Original: https://code4rena.com/reports/2025-02-recall#h-01
- Library page: https://bugbountylibrary.com/r/c4%3A2025-02-recall%3AH-01
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:access-control vuln:business-logic vuln:signature-replay

**Target:** SubnetActorCheckpointingFacet.submitCheckpoint / validateActiveQuorumSignatures
**Root cause:** validateActiveQuorumSignatures sums validator weight per signature without deduplicating signatories, so repeated entries from one validator accumulate weight.
**Steps:**
1. Call `submitCheckpoint(checkpoint, signatories, signatures)` with the same validator address repeated in `signatories` and matching signatures in `signatures`.
2. Each duplicate entry adds that validator's weight to the quorum tally.
3. With validator weight 6 and threshold 51, submit 10 duplicate signatures to reach weight 60 and pass validation.
**How found:** Code review of the weighted multisig verification: noticed signatories array is never checked for uniqueness before weight accumulation.
**Exploitation:** A single malicious validator (or small colluding minority) submits a checkpoint with its own address repeated N times and N valid signatures, accumulating weight past the quorum threshold and forcing checkpoint acceptance without broad consensus.
**Insight:** In weighted multisig schemes, always verify the signatory set is deduplicated (or use a bitmap/sorted-unique structure) before summing weight; a single signer repeating entries can satisfy quorum.