A verifier with a signature address of zero is not rejected. Anyone is allowed to sign

[code423n4]

Lines of code

https://github.com/code-423n4/2022-10-holograph/blob/main/contracts/HolographFactory.sol#L320-L335

Vulnerability details

Impact

A verifier with a signature address of zero is not rejected. Anyone is allowed to sign

Proof of Concept

  // contracts/HolographFactory.sol
  function _verifySigner(
    bytes32 r,
    bytes32 s,
    uint8 v,
    bytes32 hash,
    address signer
  ) private pure returns (bool) {
    if (v < 27) {
      v += 27;
    }
    /**
     * @dev signature is checked against EIP-191 first, then directly, to support legacy wallets
     */
    return (ecrecover(keccak256(abi.encodePacked("\x19Ethereum Signed Message:\n32", hash)), v, r, s) == signer ||
      ecrecover(hash, v, r, s) == signer);
  }

Tools Used

vscode

Recommended Mitigation Steps

check singer != address(0)

[gzeoneth]

Duplicate of #357

[gzeoneth]

As QA report