# Session signatures replay across wallets due to missing wallet binding

Session signature preimage omits wallet address, letting a signature signed for one Sequence wallet be replayed on sibling wallets sharing config and nonce to drain funds.

- Payout: Contest reward
- Severity: medium
- Program: Sequence
- Credited: Manosh19
- Disclosed: 2025-11-21
- Write-up quality: 7/10
- Original: https://code4rena.com/reports/2025-10-sequence#m-01
- Library page: https://bugbountylibrary.com/r/c4%3A2025-10-sequence%3AM-01
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:chained technique:source-review vuln:access-control vuln:signature-replay

**Target:** SessionSig.hashCallWithReplayProtection / SessionManager session signature validation
**Root cause:** hashCallWithReplayProtection hashes only chainId, nonce space, nonce, call index and call encoding, omitting the executing wallet address; SessionManager and BaseAuth/Stage2Auth validate the session image without binding it to msg.sender.
**Steps:**
1. Identify that SessionSig.hashCallWithReplayProtection (SessionSig.sol:406) excludes wallet address from preimage.
2. Obtain a valid session signature for wallet A (same config image hash and nonce as wallet B).
3. Call `sessionManager.recoverSapientSignature(payload, sessionSignature)` as wallet B and confirm it returns the same sapient image hash as wallet A.
4. Store the derived image hash in both wallets and build the BaseSig wrapper referencing the SessionManager sapient leaf.
5. Execute the identical `packedPayload` and `baseSignature` on wallet A via `walletA.execute(...)`, then replay on wallet B via `walletB.execute(...)`.
6. Both wallets transfer their balance to the attacker address.
**How found:** Code review of the session signature hashing path noticed the preimage lacked the wallet address, then verified cross-wallet validation by calling recoverSapientSignature under two different msg.sender wallets and comparing returned image hashes.
**Exploitation:** Attacker reuses a single session signature (signed for wallet A) against any sibling wallet sharing the same configuration image hash and nonce space, executing arbitrary authorized calls such as native value transfers to drain each wallet.
**Insight:** When auditing signature schemes, enumerate every field in the signed preimage and check for missing domain separators like the verifying contract address; sibling wallets or same-config deployments sharing nonces are the natural replay surface.