Skip to main content
Share Your Experience: Take the 2024 Developer Survey
56 votes
Accepted

ecrecover from Geth and web3.eth.sign

I was stuck on this issue as well for a very long time. So the solution is: Add this prefix string to your Solidity smart contract. function verify(bytes32 hash, uint8 v, bytes32 r, bytes32 s) ...
Adil Haris's user avatar
19 votes
Accepted

Ethereum ecrecover signature verification and encryption

v, r, and s are parameters that can be parsed from the signature. Here's a good example from the ethereumjs utils library: var sig = secp256k1.sign(msgHash, privateKey) var ret = {} ret.r = ...
dbryson's user avatar
  • 6,393
16 votes

Does ecRecover in solidity expects the "\x19Ethereum Signed Message:\n"-prefix

According to issue #3731: Geth prepends the string \x19Ethereum Signed Message:\n<length of message> to all data before signing it (https://github.com/ethereum/wiki/wiki/JSON-RPC#eth_sign). ...
Miguel Mota's user avatar
  • 5,163
15 votes

ecrecover from Geth and web3.eth.sign

According to issue #3731: Geth prepends the string \x19Ethereum Signed Message:\n<length of message> to all data before signing it (https://github.com/ethereum/wiki/wiki/JSON-RPC#eth_sign). ...
Miguel Mota's user avatar
  • 5,163
13 votes
Accepted

Getting an address from ethereumjs-utils ecrecover

ecrecover returns public key, you need to convert it to address with pubToAddress. pub = ethJsUtil.ecrecover(msg, v, r, s); addrBuf = ethJsUtil.pubToAddress(pub); addr = ethJsUtil.bufferToHex(...
max taldykin's user avatar
  • 2,966
12 votes
Accepted

Getting the wrong address back from ecrecover

Geth adds prefix to the message before siginig it in web3.eth.sign (see JSON-PRC spec). Without this it can be possible to trick user to sign transaction (more here). So, the correct code to sign ...
max taldykin's user avatar
  • 2,966
9 votes
Accepted

Can a message hash be recovered from a signature?

No, you cannot recover the message hash from an ECDSA signature. The siagnture is calculated by generating (x, y) = kG where k is the secret nonce and G is the generator for the curve. Then r = x and ...
Tjaden Hess's user avatar
  • 37.1k
8 votes
Accepted

Verification of externally-created ECDSA signatures in Solidity

The main issue is that you're signing "TEST" but then trying to recover the signer as though you signed a hash of "\x19Ethereum Signed Message:\n4TEST". I'm also not confident you're emitting the ...
user19510's user avatar
  • 28.1k
8 votes
Accepted

How to get the zero address from ecrecover?

I stumbled upon this thread, then I discovered this document and I now understand that setting v as any (positive?) number other than 27 or 28 will deterministically return 0x0 as the origin signer ...
Paul Razvan Berg's user avatar
7 votes

ecrecover from Geth and web3.eth.sign

So, with thanks to Adil (see above), here is the finished code that I used that definitely works with the process as outlined by me above: pragma solidity ^0.4.0; contract test { function test() {...
Daniel Mermelstein's user avatar
7 votes

Ethereum ecrecover signature verification and encryption

What exactly do v, r, and s stand for? r is the R.x value of the signature's R point. s is the signature proof for R.x v is a recovery parameter used to ease the signature verification. v is not ...
q9f's user avatar
  • 32.9k
7 votes

Sign message with web3 and verify with openzeppelin-solidity ECDSA.sol

Rob, I see that you have already resolved (which is great). For future readers: For OpenZeppelin Contracts you can check the documentation for more information, in this case the Cryptography section:...
abcoathup's user avatar
  • 1,348
6 votes
Accepted

Sign message with web3 and verify with openzeppelin-solidity ECDSA.sol

The problem is that eth.sign returns a signature where v is 0 or 1 and ecrecover expect it to be 27 or 28. A note in the documentation for web3 v0.20 is clear: Note that if you are using ecrecover,...
Ismael's user avatar
  • 30.5k
5 votes
Accepted

Solidity ecrecover and web3j Sign.signMessage() are not compatible, is it?

The problem was actually double hashing. Looking at the Web3j's signMessage() method Sign.SignatureData sig =Sign.signMessage(messageBytes, ecKeyPair); and signedMessageToKey() method String pubKey ...
earthouser's user avatar
5 votes
Accepted

Extracting Public key from signed Ethereum message or transaction in JavaScript

The easiest solution is to use ethereumjs-tx module. If you use [email protected]: const Transaction = require('ethereumjs-tx') const tx = web3.eth.getTransaction(txHash) // insert txhash here const pubkey ...
libertylocked's user avatar
5 votes
Accepted

Is it best practice to check signature malleability in ecrecover

It depends: if your use case specifically depends on the signature itself (for instance, the hash of the supplied signature) then this could be an attack vector. However, in practice, you will (...
JBrouwer's user avatar
  • 1,062
4 votes

How does one properly use ecrecover to verify Ethereum signatures?

This gist is a good example how to use ecrecover. It uses assembly to filter out the r,s,v parts of a signature and fills it into the ecrecover function. assembly { r := mload(add(sig, 32)...
Roland Kofler's user avatar
4 votes

How does one properly use ecrecover to verify Ethereum signatures?

I'm not sure if this is your only problem but at the very least, the v you're getting is wrong - it should be 27 or 28. Unfortunately a lot of signature functions won't give it to you, but you can ...
Edmund Edgar's user avatar
  • 16.9k
4 votes
Accepted

Verifying Bicoin signed message in Ethereum smart contract

Both Ethereum and Bitcoin uses the same elliptic curve for private keys secp256k1. The difference is Ethereum formats addresses as hexadecimal and bitcoin as base58. It can be made such that ...
Ismael's user avatar
  • 30.5k
4 votes
Accepted

Ethereum signature verification not matching

You need to prefix the message with the string "\x19Ethereum Signed Message:\n" and the length of the message const prefix = new Buffer("\x19Ethereum Signed Message:\n"); const prefixedMsg = util....
Joe's user avatar
  • 1,183
4 votes

How does ecrecover actually work?

The prefix has no intrinsic connection to the signature or validation function. ecrecover is simply recovering the public key (and from there the address) used to sign the 32 bytes of data you're ...
Edmund Edgar's user avatar
  • 16.9k
4 votes
Accepted

ethers.js Recover public key from contract deployment via v,r,s values

This is solved now. There was a tiny bug in the code and in the ethers library that would not correctly return the chainId and calculate the v value. It's fixed now, see here. Many thanks to ricmoo ...
Chris's user avatar
  • 1,312
4 votes
Accepted

Cannot verifiy a signature produced by Ledger in Solidity using ecrecover

The problem is that ECRecover expect the v parameter to be 27 or 28 and in the signature it is 0. r: 8ecd9d9f1ece5bd0ea1638d9a05bc194bb7536aed42fd6a09fbeb1a9479c3167 s: ...
Ismael's user avatar
  • 30.5k
4 votes
Accepted

How do you verify a Metamask signature on the server side?

Here is what worked for me: You will need a Web3 provider, for example: w3 = Web3(Web3.HTTPProvider('https://mainnet.infura.io/v3/api_key') You can recover the address using the message and signature ...
dx1's user avatar
  • 105
3 votes

I need help with signatures

From Web3 JavaScript-API docs: After the hex prefix, characters correspond to ECDSA values like this: r = signature[0:64] s = signature[64:128] v = signature[128:130] Note that if you are ...
Miguel Mota's user avatar
  • 5,163
3 votes

using solidity to verify ECDSA signature from external key pair

Since you mention it's an ECDSA key, I assume you're talking about using the same crypto that Ethereum uses for signatures. If you want to do this in Solidity, the simplest and most efficient thing ...
Edmund Edgar's user avatar
  • 16.9k
3 votes
Accepted

Does Ethereum support pairing operations?

Yes, at address 0x8 the EVM has a precompiled contract for optimal ate pairing check on the elliptic curve alt_bn128 described in EIP 197. How can we verify BGLS aggregate signatures in Solidity? has ...
eth's user avatar
  • 85.9k
3 votes

How to implement owner check in Solidity

contract Ownable { address public owner; modifier onlyOwner { require(msg.sender == owner, "Ownable: You are not the owner, Bye."); _; } constructor () public { owner =...
Rob Hitchens's user avatar
  • 55.3k
3 votes
Accepted

Can't recover address from signature (implementing EIP712 with eth_signTypedData_v4 and using OpenZeppelin)

Ok, so actually the problem was that I used an incorrect signature first, then when I try with string and bytes instead of bytes32 for the uniqueToken, I got another problem due to the dynamic types I ...
DarkCenobyte's user avatar
3 votes

SWC-117 signature and ecrecover

This is how someone can exploit it: Alice sends some tokens to Bob using the transfer function. All normal so far, since txid wasn't seen before then signatureUsed[txid] == false and the payment goes ...
0xSanson's user avatar
  • 3,249

Only top scored, non community-wiki answers of a minimum length are eligible