restrict _s to lower half of secp256k1 curve
Although ecrecover accepts signatures with these s values,
they are no longer used in Bitcoin.
As such, the signature will appear to be valid to the
Ethereum smart contract, but will likely not be accepted on Bitcoin.
@@ -192,6 +192,15 @@ library DepositRedemption {
// Instead, we consider this a no-harm-no-foul situation.
// The signers have not stolen funds. Most likely they've just inconvenienced someone
+ // Validate `s` value for a malleability concern described in EIP-2.
+ // Only signatures with `s` value in the lower half of the secp256k1
+ // curve's order are considered valid.
+ require(
+ uint256(_s) <=
+ 0x7FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF5D576E7357A4501DDFE92F46681B20A0,
+ "Malleable signature - s should be in the low half of secp256k1 curve's order"
+ );
+
// The signature must be valid on the pubkey
require(
_d.signerPubkey().checkSig(
