2

I always thought that only the person(s) in possession of the private key to an address would be able to spend or change state for that account. But by using the recover technique rather than the normal way of doing it, I’m not so sure that the statement holds.

Consider the following example:

  1. Construct a valid transaction and sign it normally.
  2. Change some part of the message. This should invalidate the signature
  3. Run the public key recovery on the signature from step 1 and the now modified message. This will produce a random address that I do not know the private key of
  4. Send funds to the random address from step 3. Now, in Bitcoin my funds would be gone and no longer in my control as I do not know the private key of the random address I sent to.
  5. BUT, for Ethereum, if I send the modified message with the invalid signature, a node will get it, derive the same random address and will see that the account has enough funds to pay any instrinsic gas and will process the message and thus change the world state (the nonce of the account will get incremented at the very least)

So i’ve now successfully modified the state of an account I do not know the private key to.

Is this scenario possible? If so, what benefit is there in using the recovery technique vs. the normal way?

Thanks

|improve this question
  • I believe that scenario is possible. I take issue with you saying "with the invalid signature," since the signature is valid (for some account). I don't see a benefit to doing this, except perhaps to prove you don't know the private key? (Show the original signed message comes from an account you control, then show that all you did was tweak the message while leaving the signature alone.) – smarx Mar 19 '18 at 23:21
  • @smarx Hey, thanks for the response. Im not sure why this would be allowed. I used the term "invalid signature" based on the definition provided in the ethereum yellow paper ([gavwood.com/paper.pdf]) on pages 19-20. On page 20 It says∀T : ∀pr : S(G(T, pr)) ≡ A(pr) My understanding of this is that the hash of the public key that corresponds to the private key (pr) used to sign the message (in step 1), must be the same as what is derived by the recovery technique. In this case it would not be. – user36103 Mar 19 '18 at 23:39
  • I believe that's incorrect. If you recover a public key from the signature, then the signature comes from the private key that corresponds to that public key. You don't know the private key, but it exists. – smarx Mar 19 '18 at 23:41
  • BTW, github.com/ethereum/EIPs/issues/820 makes use of this trick to deploy a contract at the same address on every chain without knowing the private key for the deploying address. (Search for "on any chain.") – smarx Mar 19 '18 at 23:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.