# Factory.sol : Issue with arbitrary data as signature in signature based call and deploy methods.

Factory.sol signature-based deploy/call methods lack EIP-712 domain separator and chain ID, enabling signature replay and cross-chain/cross-project signature reuse.

- Payout: Contest reward
- Severity: medium
- Program: Nftport
- Credited: obront
- Disclosed: 2022-10-18
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2022-10-nftport-judging/issues/106
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-10-nftport%3AM-2
- Tags: domain:web3 impact:integrity kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:signature-replay

**Target:** Factory.sol deploy and call signature-based methods
**Root cause:** Signatures are verified over generic data without EIP-712 domain separator, chain ID, or type hash, so a valid signature is not bound to a specific contract, chain, or function.
**Steps:**
1. Read Factory.sol L147-L225 deploy/call methods accepting signature data
2. Observe signed payload omits chain ID and domain separator
3. Replay a captured signature on another chain (e.g. Polygon) where addresses match
4. Or reuse a signature from a different DApp using the same generic format
**How found:** Code review of signature verification in Factory.sol noting absence of EIP-712 domain separator and chain ID.
**Exploitation:** Attacker captures or phishes a signature in the generic format, then replays it against the Factory on another chain or reuses it from a different DApp to trigger unauthorized deploy/call.
**Escalation:** Cross-chain replay amplifies impact since identical addresses on other chains make payloads meaningful.
**Insight:** When auditing signature-based methods, check whether the signed struct includes domain separator, chain ID, and type hash; generic formats enable cross-chain and cross-DApp replay.