Some smart contract bugs scream at you. A missing onlyOwner, a reentrancy with the state update after the transfer. Signature replay is not one of those. The code looks careful. It checks a signature, it recovers the right address, it gates on the result. And it lets an attacker replay the same approval forever. Here is the bug class, three ways it shows up, and how I check for it.
The setup: meta-transactions and permit
Lots of protocols let users sign a message off-chain and have someone else submit it on-chain. Gasless approvals, relayers, permit-style flows. The contract recovers the signer from the signature and acts on their behalf. The whole security model rests on "only the real signer could have produced this signature."
That is true. The problem is that a signature, once produced, can be used more than once unless you stop it.
Version 1: no nonce
