Signature Replay Vulnerability Scanner

WHAT IT DOES

Signature Replay Vulnerability Scanner is a security-focused tool that scans Solidity contracts for signature replay vulnerabilities, particularly in EIP-2612 permit functions and other signature-based authorization patterns. It takes contract source code from the user and analyzes it for signature verification logic, nonce tracking, deadline validation, and domain separator usage. The tool identifies critical patterns including permit function implementations, nonce increment locations, ecrecover usage, ECDSA recovery functions, and chain ID usage for cross-chain replay protection. Each finding is classified by severity (critical, high, medium, low, or info) based on the potential for exploitation. The tool provides detailed descriptions of each vulnerability, the exact location in the source code, and actionable recommendations for remediation. This enables developers to identify and fix signature replay vulnerabilities before deployment.

HOW TO USE

Paste your Solidity contract source code into the input area. Click "Scan for replay vulnerabilities" to analyze the code. The tool will display a summary showing the number of permit functions found and counts of critical, high, medium, and low severity issues. Each vulnerability entry includes the name, severity, description, location (line number and context), and a recommendation for fixing the issue. The scan report can be copied or downloaded as JSON for further analysis.

TECHNICAL NOTE: SIGNATURE REPLAY PATTERN DETECTION

The tool uses regex-based pattern matching to detect signature replay vulnerabilities in Solidity source code. It scans for permit function definitions, nonce mappings and increments, deadline checks, ecrecover usage, ECDSA recovery functions (from OpenZeppelin), DOMAIN_SEPARATOR definitions, and chain ID usage. Each pattern is mapped to a severity level based on the potential for replay attacks: critical for permit functions without nonce or deadline checks, high for ecrecover without proper validation, medium for permit functions with incomplete replay protection, low for domain separator or chain ID usage, and info for informational findings. The tool also detects if a permit function exists but lacks nonce increment, which is a critical vulnerability.

WHAT IT CANNOT SEE

The tool cannot detect all signature replay vulnerabilities without context; some patterns may be safe depending on the specific application logic. It is limited to the accuracy of the source code analysis; syntax variations may cause false positives or negatives. It cannot detect replay issues in external contracts or libraries that are imported into the contract. It cannot verify if a signature replay vulnerability is actually exploitable in the specific deployment environment. The tool is limited by the parser's ability to handle Solidity syntax variations, including newer language features. It cannot scan for signature replay on non-EVM chains.

PLEASE NOTE

This tool is designed exclusively for Solidity contracts on EVM-compatible chains. It does not support other smart contract languages. The scan results are based on static analysis and may produce false positives or miss some issues. Always verify the findings with manual review and testing. The tool is read-only and does not modify any state. The tool provides no warranty that the scan results are complete or accurate; users are responsible for validating all findings and implementing appropriate fixes.