# If a hat is owned by address(0), phony signatures will be accepted by the safe

ecrecover returns address(0) for malformed v values; if a hat is held by address(0), phony signatures count as valid signers, bypassing multisig threshold.

- Payout: Contest reward
- Severity: medium
- Program: Hats
- Credited: duc
- Disclosed: 2023-02-15
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2023-02-hats-judging/issues/39
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-02-hats%3AM-11
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:chained technique:source-review vuln:auth-bypass vuln:signature-replay

**Target:** HatsSignerGateBase.countValidSignatures / Hats ERC1155 balanceOf
**Root cause:** countValidSignatures uses ecrecover without rejecting address(0); isValidSigner checks HATS.isWearerOfHat which resolves to ERC1155 balanceOf, and if a hat is owned by address(0) that balance is nonzero, so recovered address(0) passes validation.
**Steps:**
1. Admin mints/transfers a signer hat to address(0) (burn, supply inflation, or pending delegatee).
2. Attacker crafts a signature with v not in {27,28} so ecrecover returns address(0).
3. Attacker submits transaction to the safe with this phony signature.
4. countValidSignatures recovers address(0), isValidSigner(address(0)) returns true via isWearerOfHat/balanceOf.
5. Phony signature counts toward threshold; in 2/3 setup one party alone reaches quorum and executes arbitrary transactions.
**How found:** Code review of countValidSignatures: noticed ecrecover is used without a zero-address check, then traced isValidSigner -> isWearerOfHat -> balanceOf -> ERC1155 balanceOf and realized no address(0) guard exists, making a zero-owned hat a free signer.
**Exploitation:** Attacker needs a hat owned by address(0) and submits a transaction with a malformed-v signature that ecrecover maps to address(0); the gate counts it as a valid signer, letting a single signer meet the threshold and execute arbitrary safe transactions to drain funds.
**Escalation:** In a 2/3 multisig, one compromised signer plus the phony address(0) signature reaches majority, enabling arbitrary transactions and fund theft.
**Insight:** When auditing signature-counting multisig gates, trace the full isValidSigner call chain to the underlying balance/storage check and test whether ecrecover's address(0) return can satisfy it; also check whether any admin path can mint/transfer a signer role to address(0).