# Missing deadline parameter in register signatures

Olas ServiceManager registerAgentsWithSignature omits a deadline, letting a service owner replay an operator's old signature to force bond transfers from the operator.

- Payout: Contest reward
- Severity: high
- Program: Olas
- Credited: santipu_
- Disclosed: 2026-05-18
- Write-up quality: 7/10
- Original: https://code4rena.com/reports/2026-01-olas#h-07
- Library page: https://bugbountylibrary.com/r/c4%3A2026-01-olas%3AH-07
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic vuln:signature-replay

**Target:** ServiceManager.sol registerAgentsWithSignature (EVM smart contract)
**Root cause:** The signed message hash for registerAgentsWithSignature includes operator, owner, serviceId, agents, ids and nonce but no deadline, so a signature stays valid indefinitely until the nonce changes.
**Steps:**
1. Alice signs getRegisterAgentsHash(operator, serviceOwner, serviceId, agentInstances, agentIds, nonce) for Bob's service.
2. Bob does not use it; Alice registers agents directly and later unbonds, retrieving her deposit.
3. Bob reconfigures the service and reopens registrations.
4. Bob calls `registerAgentsWithSignature(operator=Alice, serviceId, agentInstances, agentIds, signature)` with the old signature.
5. Contract verifies hash against unchanged nonce, then calls registerAgentsTokenDeposit, executing `safeTransferFrom(token, Alice, address(this), totalBond)` using Alice's standing allowance.
**How found:** Code review of the signature hash construction in registerAgentsWithSignature, noticing absence of a deadline/expiry field compared to typical signed-message patterns, then tracing the call into registerAgentsTokenDeposit to confirm token pull from operator.
**Exploitation:** A malicious service owner stores a previously issued operator signature, waits until the operator unbonds and reopens registration, then replays the signature to force registerAgentsTokenDeposit to pull the operator's bond via existing ERC20 allowance, locking funds without consent.
**Escalation:** Relies on operators keeping infinite token allowances to ServiceRegistryTokenUtility, amplifying likelihood of forced bond transfers.
**Insight:** When auditing signature-based registration/authorization flows, enumerate every field in the signed hash and check for missing expiry/deadline; then trace downstream effects (token pulls, allowances) to see if replay yields real fund movement rather than just state change.