# Signature replay via inconsistent encoding

Same proof or signature decoded differently by validator and consumer, letting one claim count many times

_Area: DeFi accounting and math bugs. Seen in 4 disclosed reports; 2 confirmed bounties: $1,000,000 and $2,000,000; latest 2023-12-28. Updated 2026-10-23._

## How it works
A proof, signature, or identifier is checked by one routine and consumed by another that accepts a different set of encodings. The security check (uniqueness, executor identity, nonce) is computed over one representation, while the action is taken on another. Because the two decoders disagree, one real authorization maps to many distinct "keys," so the same claim can be replayed. The broken assumption is that a value has a single canonical encoding; in practice decoders are lenient and disagree.

## Where it shows up
- A proof/exit ID derived from a decoded field (e.g. branchMask) in one function, while the Merkle proof is verified by a separate decoder [E2](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-polygon-double-spend-bugfix-review-2m-bounty.md).
- Bridge proof validation keyed on `executor_id`/caller identity, where read-only or view entrypoints also set that identity [E1](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-aurora-withdrawal-logic-error-bugfix-review.md).
- Meta-transaction or forwarder paths where a signature is checked but nonce/domain binding is missing or not tied to the consumed action [E3](https://bugbountylibrary.com/r/dhl%3A20231228-dominott.md).
- `multicall`/batch entrypoints that let a signed or burn action be re-invoked within one transaction [E3](https://bugbountylibrary.com/r/dhl%3A20231228-dominott.md).
- Any place a hash, ID, or nonce is computed over raw bytes but compared after normalization.

## How to review
Identify every value used both as a security key and as an action input. The invariant: the uniqueness key must be computed over exactly the bytes the verifier accepts, and the verifier must accept only one canonical encoding per semantic value. Check that proof validation binds to the same executor/caller that performs the action, and that signatures bind nonce, chain, contract, and the specific action. For each decoder, enumerate all encodings it accepts and confirm the key covers all of them.

## Variants seen
- Two decoders of the same HP-encoded field disagree, yielding ~224 encodings per exit [E2](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-polygon-double-spend-bugfix-review-2m-bounty.md).
- View/read path sets executor identity, so attacker-controlled return bytes become a valid proof [E1](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-aurora-withdrawal-logic-error-bugfix-review.md).
- Signature replay plus precision loss in pair sync after a burn via multicall [E3](https://bugbountylibrary.com/r/dhl%3A20231228-dominott.md).

## Impact and severity
Critical: full bridge drain (50,550 ETH [E1](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-aurora-withdrawal-logic-error-bugfix-review.md); ~$850M at risk [E2](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-polygon-double-spend-bugfix-review-2m-bounty.md)) and profitable reserve manipulation [E3](https://bugbountylibrary.com/r/dhl%3A20231228-dominott.md). Severity rises when the replayable value guards a pooled custodian and when the encoding ambiguity is large (hundreds of variants).

## Why fixes fail
Fixing only the consumer decoder leaves the uniqueness key computed over the old representation; both sides must agree on one canonical form [E2](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-polygon-double-spend-bugfix-review-2m-bounty.md).

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-aurora-withdrawal-logic-error-bugfix-review.md
- E2: https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-polygon-double-spend-bugfix-review-2m-bounty.md
- E3: https://bugbountylibrary.com/r/dhl%3A20231228-dominott.md