In this track: Advanced security reasoning
advanced · 4 MIN READ

Signature replay across chains

A message accepted on one chain may be accepted elsewhere without proper binding.

LET’S PICTURE IT

A permission form should identify the jurisdiction where it is valid.

SEE IT FOR YOURSELF
From a public address to a verified signatureStep 1 / 4
From a public address to a verified signaturePublic address0x0000…0001Share to receiveAnother personCan read the addressCannot sign for youPublic identifier ≠ secret authorizationLocal signerPrivate key stays hereSign the chosen requestSigned requestMessage + signatureSecret key not includedThe moving packet represents a signature, not a keySignatureCheck the exact messageCheck the signing contextVerificationAuthorization checkedIntent still mattersValidity and safety are different questionsWallet interfaceReads public dataRequests authorizationNetwork stateBalances and recordsIndependent verificationNo wallet is connected in this local illustration

An address is public receiving information. It is not the private key that authorizes actions.

Animated local teaching model. No wallet, RPC or live blockchain data. Some labels and hashes are abbreviated for readability.

Identify the shared authorization

If two deployments accept the same digest and signer, one signature may be usable on both. Similar contract addresses do not remove that possibility.

Bind the intended domain

Include and enforce the relevant chain and verifying-contract context under a suitable signing scheme. A field merely shown by a website is insufficient.

Add local consumption rules

Even correctly separated chains need nonce or usage rules within each intended domain. Cross-chain separation and same-chain replay prevention solve different problems.

Test changed domains

Generate a fixture for the intended chain, then change chainId or verifying contract. The altered context should not satisfy the original authorization policy.

Work through the boundary

same signer + same unbound digest on chain A and B
→ possible cross-chain acceptance
review enforced domain and nonce scopes

A simplified local review scenario. The example establishes a question to test, not a guarantee of production safety.

QUICK CHECK · NO PRESSURE

Does same-chain nonce consumption alone establish cross-chain binding?

Your progress stays in this browser.
Keep exploring the original referenceEthereum Improvement Proposals ↗

Original explanations by EtherTools. Examples are educational and source-linked; this site is independent of the Ethereum Foundation. Our approach.