Executive Summary

This vulnerability exists in gnark versions prior to 0.14.0 where the Verify function in eddsa.go and ecdsa.go used the S value from a signature without checking that it is within the valid range (0 ≤ S < order). This lack of validation leads to signature malleability, meaning multiple distinct signatures can be considered valid for the same message. Because gnark's native EdDSA and ECDSA circuits lack constraints to prevent this, it allows multiple witnesses to satisfy the same public inputs, enabling signature malleability and potentially allowing double spending in protocols relying on these signatures.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to signature malleability, which means an attacker can create different valid signatures for the same message. In protocols where nullifiers or anti-replay checks depend on signature components R and S, this can allow double spending or replay attacks, undermining the integrity and security of transactions or operations relying on gnark's signature verification.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade gnark to version 0.14.0 or later, as this version addresses the signature malleability vulnerability by properly validating the S value in signatures.

Useful 0 Not Useful 0