Hunting for Cryptographic Ghosts - Bug Hunters Guide to Signature Malleability

The session opens with a short primer on symmetric and asymmetric cryptography, then uses a casino roulette analogy to explain why digital signatures let a bettor check that a result was fixed before the spin. It then breaks down the parts of an elliptic-curve signature, the r and s values and the recovery value v, which is commonly 27 or 28 on Ethereum.

The core point is that because the recovery byte can be flipped, someone who sees a valid signature on a public chain can produce a second signature that still verifies for the same signer. Replaying that signature can execute the same transfer twice. The presenters tie this to large past bridge incidents, including Poly Network and Wormhole. They describe an open-source scanner they built that checked about 150 live transactions, found 83 with signatures, and flagged four as vulnerable to this manipulation.

The last part tested whether large language models write safe wallet code. In the presenters' prompts, several models produced vulnerable Solidity for a simple transfer contract, and nudging the prompt with signature details raised the vulnerable rate. The practical takeaway is to review signature handling, including v normalization and replay protection, rather than trusting generated code or assuming a signature cannot be altered.