Dormant Signer

The brief

A custody desk processed withdrawals using an automated off-chain signer. After operations ended, the operator filed a recovery escrow and destroyed the production Authorizer contract. The signer's private key was never recorded, and the operator believes the escrow is permanently lost. Recover the plaintext of the escrow filed by the destroyed production authorizer.

• dormant-signer.zip, 74 KB

In short

Dormant Signer ships a custody desk's whole chain as 380 signed transactions. Two withdrawals used an ECDSA nonce and its negation, which gave the Offensive Lab the signer's private key, the signature that masks the escrow and, after replaying every settlement, the escrow itself.

A chain that lives in an archive

The desk's chain ships as 380 signed transactions and three Vyper contracts. Two Authorizers came from the same deployer. One was only sealed. The one created at transaction 52 is the only target of destroy, so its escrow is the one to open.

An escrow behind two masks

The filed value is the escrow XOR two masks. One is a running digest of every settlement, which the archive holds. The other hashes the signer's liveness signature, and that needs a key nobody recorded.

Same r, opposite v

Transactions 137 and 234 carry the same r, with v 27 and 28. So the signer used nonce k and then n minus k. Two equations, two unknowns, and the private key falls out. Its address is the trusted signer.

Every settlement, replayed in order

With the key, re-signing the 22 archived digests gives 21 identical signatures, and the odd one is 234. Replaying the settlements in order, 20 pass and 2 are refused, which leaves the running digest at 0x8e7eccfe.

Thirty characters of plain text

Signing the liveness message with the key gives the mask 0x7cf705d8. The value filed by the destroy call, XOR the digest, XOR the mask, decodes to layout_undead_borrowed_betrays. That is the flag.

The insight

A nonce reused as k and n minus k leaks an ECDSA key as surely as a repeated k, and the flipped v gives it away.

The flag

hiCTF{layout_undead_borrowed_betrays}