No wallet works this way. Anywhere in the ecosystem. That's probably why users have had so many compatibility issues with their
Safe multi-sig deployments and whatever other software/hardware they were using at the time (i.e., Metamask, Ledger, etc.). The whole reason for these two EIP standards is to ensure that messages can't be repurposed across different domains. So that means if me, Bob & Joe own two multi-signature proxies, then a message that we all signed for proxy one should not be able to be validly used on proxy two. This is basic signature security.
The whole purpose of prefixing the hash of a multi-signature transaction with the
0x19 and 0x01 bytes + a domain separator is to (a) establish that the information to be hashed and verified against was meant to be a transaction (not a message; there is a difference) and (b) ensure that a message that was signed to be used on one proxy could not be replayed on another proxy that happens to have the same exact set of owners (even if that second proxy was at the same nonce at the time the first message was signed). Where Safe Fucks Up
All one has to do to have signatures verified against another hash is change the
v value of the r, s and v signature split. This value has no bearing on the signature produced, it just tells us how we need to interpret the signature. If we change that byte in the calldata & replay that very same transaction the only thing that changes is the hash that the signatures are verified against. Signatures are not being verified against the data the owners think they are signing. In the Bybit hack, those signatures that were provided were not verified against that transaction data. So all that calldata you see in explorers that show you the full decoded struct of the hack TX with the "to" address being some
0x9622... address, followed by 0 in the value, 1 for the operation and 0xa9059cbb....bdd077f651ebe7f7b3ce16fe5f2b025be2969516... (68 byte) for the data etc...??That's not what the signatures provided actually verify against. At all. Maybe something akin to it - but not that data directly.
If you're wondering how, that's what's broken down and explained in the pdf that I attached (getting ready to publish a quick GH issue in a few places as well).