Please add ꜱᴡᴄ for case where attacker is a able to pass hash directly to ecrecover !

[ytrezq]

If verifier contract doesn’t hash a message itself and the hash doesn’t require a pre‑image, then there’s a problem similar but different from signature malleability described here.

[maurelian]

LGTM. It's Pitfall #2 at that URL.

[chaals]

This repo is no longer maintained, and we are not adding new SWCs (has probably become obvious since this was filed).

So closing this as "won't get fixed"