Different signature encodings can relate to the same authorization.
LET’S PICTURE IT
Two differently formatted stamps can still refer to the same document and signer.
SEE IT FOR YOURSELF
From a public address to a verified signatureStep 1 / 4
An address is public receiving information. It is not the private key that authorizes actions.
An address is public receiving information. It is not the private key that authorizes actions.The local signing system uses secret authorization material. It produces a signature; the private key is not sent along with it.A verifier checks the signed request under the account’s rules. A valid signature does not by itself prove that the action is safe.Balances belong to network state. A wallet is an interface and signing system, not a box containing coins.
Animated local teaching model. No wallet, RPC or live blockchain data. Some labels and hashes are abbreviated for readability.
Recognize the ECDSA issue
ECDSA has related signature representations unless canonicalization rules restrict them. A verifier must follow the required s-value and recovery conventions.
Separate transaction and recovery rules
Ethereumtransaction validity introduced low-s restrictions through EIP-2. The ecrecover precompile’s acceptance rules are not identical to those transaction restrictions.
Do not use raw signature bytes as the only replay key
If an authorization can have alternative accepted representations, consuming only the exact byte string can miss equivalent signatures. Bind replay control to the intended message and protocol state.
Use maintained validation code
Normalization, compact formats and invalid recovery handling are easy to mishandle. Verify the requirements of the actual signature scheme and application.
Inspect the distinction
Replay key candidate: raw signature bytes alone → insufficient in some designs
Better authorization model: domain + signed action + nonce consumption
These are local teaching values, not a signature request or a live-chain lookup.