# resolveQueuedTrades is intended to be non atomic but invalid signature can still cause entire transaction to revert

BufferRouter's _validateSigner calls ECDSA.recover which reverts on malformed/zero-address signatures, breaking intended non-atomic resolveQueuedTrades and unlockOptions.

- Payout: Contest reward
- Severity: medium
- Program: Buffer
- Credited: 0x52
- Disclosed: 2022-11-11
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2022-11-buffer-judging/issues/84
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-11-buffer%3AM-3
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:incomplete-fix technique:source-review vuln:dos vuln:signature-replay

**Target:** BufferRouter.sol _validateSigner / resolveQueuedTrades / unlockOptions
**Root cause:** _validateSigner uses ECDSA.recover, which reverts in _throwError for invalid-length signatures or signatures recovering to address(0), instead of returning false.
**Steps:**
1. Call BufferRouter#resolveQueuedTrades (or unlockOptions) with a queued trade whose signature is malformed (invalid length) or recovers to address(0)
2. _validateSigner computes digest and calls `ECDSA.recover(digest, signature)`
3. recover reverts in _throwError, reverting the whole transaction instead of skipping the bad trade
4. Other valid trades in the same batch are also reverted, defeating the intended non-atomic behavior
**How found:** Code review of _validateSigner; sponsor claimed tests covered wrong signatures, researcher checked OpenZeppelin ECDSA.recover source and found _throwError reverts on invalid length and address(0) recovery, which tests did not cover.
**Exploitation:** A malformed or zero-address-recovering signature in one queued trade causes the entire resolveQueuedTrades/unlockOptions batch to revert, blocking resolution of otherwise valid trades (griefing/DoS on batch processing).
**Insight:** When a function is designed to be non-atomic (skip failures), audit every sub-call for revert paths — OZ ECDSA.recover reverts on invalid-length sigs and address(0) recovery, so use tryRecover. Sponsor 'we tested it' claims should be checked against the library's actual revert conditions.