ECDSA (ecrecover) - How an attacker can construct a hash and signature that look valid

Question

I found information, that it is possible to construct a hash and signature that look valid if the hash is not computed within the contract itself (we are talking about ECDSA/ecrecover here).

So, the task is to construct a hash + v, r, s that would resolve to a particular address using ecrecover(). I have access to several signed hashes.

Can anybody provide an additional clue how it would be possible? Unfortunately, there is very little information on this topic.

============ I was adviced to clarify the issue. So, this is the correct question: given (hash,r,s) known to verify against an ECDSA public key that can be recovered, construct (hash′,r′,s′) with hash′≠hash that verifies against the same public key.

Answer 1

I think what you are doing is forge a signature which seems a bit harduous, I've quicky read the article you mentionned and it's also a bit unclear.

It does makes me think about the keyless deployment method from https://eips.ethereum.org/EIPS/eip-820#deployment-method

1. Generate a transaction that deploys the contract from a new random account. This transaction must not use EIP-155 so it can work on any chain. This transaction needs to also have a relatively high gas price in order to be deployed in any chain. In this case, it's going to be 100Gwei.
2. Set the v, r, s of the transaction signature to the following values: v: 27 r: 0x79BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798 s: 0x0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa This nice s value is a random number generated deterministically by a human.
3. We recover the sender of this transaction. We will have an account that can broadcast that transaction, but we also have the waranty that nobody knows the private key of that account.
4. Send Ether to this deployment account.
5. Broadcast the transaction.

This operation can be done in any chain, guaranteed that the contract address is going to always be the same and nobody will be able to mess up that address with a different contract.