Is nonce necessary to prevent signature replay on smart contracts if the method is idempotent?

Question

I have a smart contract in which only I can submit transactions through onlyOwner modifier. If users want to interact with the contract, I make the users sign the parameters of the method and verify the signature on the contract level to provide users a gasless experience.

This specific method can be executed multiple times without a revert when called with the exact same parameters, so it is suffering from replay attacks. But here is the catch, I don't care. Because the method is simply idempotent, meaning that it has zero effect on the current state to run the exact same method with exact same parameters.

Do I still need to add nonce to be safe, or would that be considered more trustworthy in the web3 community? Is there anything I am missing here?

Answer 1

If your method is truly idempotent and repeated calls with the same parameters don't alter your contract's state or have any adverse effects, then adding a nonce might not be necessary for this specific function.

However, using nonces is a common security practice in Ethereum to prevent replay attacks, and it could add an extra layer of surety for users and other developers interacting with your contract.

It's also worth considering that while this function may be idempotent, future modifications or additions to your contract might not have the same property.

Therefore, using nonces could be a proactive step towards maintaining security and trustworthiness in your smart contract.

Thanks.