0

I signed a message that contained a nonce: 0x..... I suspect this message was calculated based on the balance of my account to withdraw the funds that were stolen (fortunately it wasn't a lot).

Can this message be replayed if I were to add more funds to this account?

Improve this question

1 Answer 1

Reset to default
1

Since the signed message contained the nonce you can't be replay attacked.

See: "A replay attack is when a signature is used again (“replayed”) to claim authorization for a second action. For our example, it would be a serious security flaw if the recipient of a payment could submit the same signature again to receive a second payment. Just as in Ethereum transactions themselves, messages typically include a nonce to protect against replay attacks. The smart contract checks that no nonce is reused"

from this

Improve this answer
2
  • In other words, signing a message nonce can be used to authorize an action once. So in my case, the 0x... message I signed that was used to withdraw ETH from my account can't be replayed?
    – a11hard
    Nov 12, 2022 at 16:56
  • Not really. A nonce is just a number that is added to the message signature to make sure that message cannot be reused a second time. If that message (i.e. "Me, Adgezaza, sends 1 eth to address 0x...", is reused now, the nonce attached to it will not match your nonce attached to your address and therefore will be rejected. You don't sign a message nonce, a nonce is attached to your message so that message isn't reusable
    – Olivier Demeaux
    Nov 12, 2022 at 17:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.