Submitted by Pelz, also found by 0xGondar, 0xvd, Abysser, agadzhalov, aua_oo7, demonhat12, farismaulana, firmanregar, gregom, HardlyDifficult, hyuunn, i3arba, Infect3d, JCN, Jumcee, komane007, Lamsy, Limbooo, LouisTsai, ok567, patitonar, persik228, Pocas, Prestige, reflectedxss, s4bot3ur, sabanaku77, safie, santipu_, SBSecurity, skypper, ubl4nk, web3km, wiasliaw, and X0sauce
https://github.com/code-423n4/2025-01-next-generation/blob/499cfa50a56126c0c3c6caa30808d79f82d31e34/contracts/Forwarder.sol#L101
https://github.com/code-423n4/2025-01-next-generation/blob/499cfa50a56126c0c3c6caa30808d79f82d31e34/contracts/Forwarder.sol#L153
The _verifySig function in Forwarder.sol accepts the domainSeparator as a user-provided input instead of computing it internally. This introduces a vulnerability where signatures can be replayed across different chains if the users nonce matches on both chains.  
Additionally, there is no deadline check, meaning signatures remain valid indefinitely. This lack of expiration increases the risk of signature replay attacks and unauthorized transaction execution.  
Affected Code
Additional Risk: The absence of a deadline check means an attacker could store a signature indefinitely and execute it at any time in the future.  
By implementing these fixes, the contract can prevent signature replay attacks and unauthorized transactions across different chains.
0xsomeone (judge) increased severity to High and commented:
givn (warden) commented:
0xsomeone (judge) commented:
