analog-labs / analog-gmp Goto Github PK

Description

Create a video walkthrough for the general audience interested in understanding GMP mechanisms, clearly distinguishing the differences from other protocols, i.e. smart contract performance improvements, embedded assembly, Gasfee comparison, etc

• Gateway walkthrough
• GMP usage exemple

Description:

There is a critical security issue in the updateKeys() function of the Gateway contract that allows for the reuse of a signature to re-register a revoked key.

Steps to Reproduce:

1.	Register the key “xyz” with signature1.
2.	Revoke the key “xyz” with signature2.
3.	Reuse signature1 to re-register the key “xyz”.

Issue:
The current implementation does not prevent the reuse of the original registration signature (signature1) after the key has been revoked. This allows any user to re-register the key “xyz” with signature1, bypassing the intended revocation.

Proposed Solution:
To fix this issue, the function should keep track of used signatures or include a mechanism that invalidates the old signature once the key is revoked.

Impact:
This flaw could potentially allow unauthorized users to re-register revoked keys, compromising the security and integrity of the key management system.