CVE-2022-31153: `ecdsa_ptr` points to reference in Account lib's `execute` · Issue #386 · OpenZeppelin/cairo-contracts

🛑 The transaction was rejected but no contract address was identified in the error message.
Error message:
Error at pc=0:133:
Got an exception while executing a hint.
Cairo traceback (most recent call last):
Unknown location (pc=0:746)
Unknown location (pc=0:682)
Error message: Account: invalid signature
Unknown location (pc=0:347)
Unknown location (pc=0:321)

Traceback (most recent call last):
  File "<hint14>", line 1, in <module>
  File "/app/src/starkware/starknet/services/batcher/starknet_batcher_venv-site/starkware/cairo/lang/builtins/signature/signature_builtin_runner.py", line 94, in add_signature
    ), f"Signature hint must point to the signature builtin segment, not {addr}."
AssertionError: Signature hint must point to the signature builtin segment, not 14:0.

Neither the StarkNet test environment nor the devnet raise this error.

let (local ecdsa_ptr : SignatureBuiltin*) = alloc()

The Signature hint points to this reference (which the SignatureBuiltinRunner does not like). To resolve this, I suggest adding the ecdsa_ptr: SignatureBuiltin* as an implicit arg to execute, eth_execute, and _unsafe_execute in the Account library and EthAccount’s execute as well.

Another solution would be to isolate the functionality of both accounts (thus removing _unsafe_execute), so we don’t have to pass the implicit ecdsa_ptr in the EthAccount methods.