ecrecover zero-address return unchecked

Evidence summary #

This factor is also Cat 10 F-151 (bridge-specific). For Cat 1 scope: SpokePool periphery contracts use EIP-712 signatures (OZ standard ECDSA.recover). OZ standard ECDSA.recover reverts on zero-address result rather than returning address(0). The SpokePool's relayer signature verification uses OZ ECDSA library (per audit trail). No unguarded ecrecover call identified in OZ 18-audit series for EVM contracts.

Sources #

Methodology #

Determine whether any `ecrecover` call result is used without a `!= address(0)` guard.

See the full factor methodology and distribution across all protocols →