EIP-8151: Private Key Deactivation Aware ecRecover

This would badly break existing deployments of the OP stack. In order to support ecrecover on the L2, the fault proof game executes the precompile on L1 and stores the result. See Fault Proof - OP Stack Specification. Since this happens asynchronously, you can do the following attack: take an EOA and call ecrecover on a signature made by that EOA on L2. After this transaction has been posted on L1 but before the batch is proven, deactivate the EOA on L1. Now ecrecover on L1 returns the zero address. Now you can challenge the batch with your transaction, and since ecrecover does not return what it did on L2, you will win the challenge and get paid.

I don’t think there is a good way to fix this. It’s possible to fix the OP stack, you would just need to not accelerate the precompile anymore. That’s awkward though. “Upgrading” immutable smart contracts that use ecrecover is a noble pursuit, but unfortunately it looks like changing precompile behavior (beyond gas) in-place is a huge no-go.

2 Likes