I am wondering if it is considered best practice to guard against signature malleability to check against the half curve order like this or if this is totally unnecessary.

uint256 constant HALF_CURVE_ORDER = uint256(0x7fffffffffffffffffffffffffffffff5d576e7357a4501ddfe92f46681b20a0);

function verifySig(
    bytes32 hash,
    bytes32 r,
    bytes32 s,
    uint8 v
) public {
        uint256(s) <= HALF_CURVE_ORDER,
        "found malleable signature, please insert a low-s signature"

    address signer = ecrecover(hash, v, r, s)
    // do stuff

1 Answer 1


It depends: if your use case specifically depends on the signature itself (for instance, the hash of the supplied signature) then this could be an attack vector. However, in practice, you will (probably) use the contents of the signature: for instance, you supply a nonce equivalent parameter to the data you are signing.

However, I do think that this is still a very good practice. For instance, in the Homestead hard fork of Ethereum, a guard guarding against this is included in the fork. See EIP 2 point 2.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.