---
title: "Discussion on \"Signature Replay Attacks\" | Hashnode"
description: "Discussion on \"Signature Replay Attacks\". Common vulnerabilities leading to signature replay attacks"
url: "https://hashnode.com/posts/signature-replay-attacks/6423581fe3047059af78227a"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [Signature Replay Attacks](https://dacian.me/signature-replay-attacks?utm_source=hashnode&utm_medium=feed)

Common vulnerabilities leading to signature replay attacks

Mar 28, 2023 · 6 min read · dacian.me  
Updated Nov 2, 2023  
Read the article

-   [#smart-contracts](https://hashnode.com/tag/smart-contracts)
-   [#solidity](https://hashnode.com/tag/solidity)
-   [#signature-replay](https://hashnode.com/tag/signature-replay)
-   [#ethereum](https://hashnode.com/tag/ethereum)

## Written by

[Dacian](https://hashnode.com/@dacian)

@dacian · in your storage

  
[View profile](https://hashnode.com/@dacian)

in your storage

trust nothing, verify everything

## Responses 1

Markdown supported · ⌘↵ to post

[Gaurang](https://hashnode.com/@GaurangBrdv)

[May 24, 2025](https://hashnode.com/posts/signature-replay-attacks/6423581fe3047059af78227a/comment/68318a704333f5a924a88138)

Hii, Dacian.

Can you elaborate more of `missing parameter` cause i am not able to understand it properly.

I hope you will help me.

[Dacian](https://hashnode.com/@dacian)

[May 26, 2025](https://hashnode.com/posts/signature-replay-attacks/6423581fe3047059af78227a/comment/68318a704333f5a924a88138#reply-6834478e52a7aca819919509)

Let's say there is a signature to transfer an amount of tokens X use in function call f().

If X isn't part of the signature itself, then someone can take the same signature but when calling f() pass in a different (say larger) parameter for the token amount.

The signature will still verify since the amount wasn't part of the signature, but now more tokens will be transferred than the signer intended.

Every parameter which is important to making the function call f() work correctly should also be part of the signature passed to f() and used to validate the call.

Hope this explanation helps!

[Gaurang](https://hashnode.com/@GaurangBrdv)

[May 26, 2025](https://hashnode.com/posts/signature-replay-attacks/6423581fe3047059af78227a/comment/68318a704333f5a924a88138#reply-68347bd47bdd6c7c6cbf840a)

[Dacian](https://hashnode.com/@dacian) How the both function is related to the amount? Like you specified in blog.