- The Gnosis Safe implementation nests EIP-712 (typed, domain-separated) inside EIP-191 (personal message) hashing for
v > 30 signatures.- This effectively breaks the domain separation by allowing a signature to be validated against two distinct hash contexts.
- This doubles an attacker's “shot” at producing a collision: they can attempt to find a preimage that matches a hash under either scheme.
- This raises practical collision chances beyond the theoretical security bound of a single hash function collision.
- There are 100+ legitimate candidate transactions the attacker could target.
- Each provides a unique target hash `H(X)` signed by authorized owners.
- The attacker’s task reduces to finding a malicious transaction
M with hash H'(M) (under buggy verification) matching any of these H(X).- This multiplicity further increases the attacker’s probability of success, effectively multiplying the collision probability by ~100.
- Assuming effective entropy
k ≈ 40 bits (a conservative estimate from variability and real-world constraints).- Probability of random collision in one attempt: ~1 in 2^40 (~1 in 1 trillion).
- With 100 target hashes, effective collision probability per attempt: ~100/2^40 ≈ 1/2^33.
- With modern ASIC or FPGA farms capable of trillions of hashes per second, finding a collision in hours or days becomes feasible.