CryptoAudit on Nostr: An important point about the ecrecover function is that in some cases when the ...

An important point about the ecrecover function is that in some cases when the signature is not valid, this function returns a random address instead of returning address 0.
Both cases can be seen in the code below and you can easily write a rule for it with the @semgrep tool.

```solidity
address signer = ecrecover(hash, v, r, s);
require(signer == owner, "MyFunction: invalid signature");
require(signer != address(0), "ECDSA: invalid signature");
```

quoting
nevent1q…kc82

If you have worked with Solidity, you are familiar with the ecrecover function. If signature is not valid, this function returns signing address or 0. Therefore, the output of this function should always be checked.

You can easily write a rule for this pattern with the @semgrep tool and find all the cases that are not like this.