Signature replay attacks for different identities (nonce on wrong party)

Handle cmichel Vulnerability details A single QuickAccount can serve as the "privilege" for multiple identities, see the comment in QuickAccManager.sol: NOTE: a single accHash can control multiple identities, as long as those identities set it's hash in privilegesaddressthis. this is by design If...

QuickAccManager.sol#send() Potential replay attack

Handle WatchPug Vulnerability details In QuickAccManager.solsend, addressidentity is not included in the txHash, makes it possible to replay the transaction when the same QuickAccount accHash controls multiple Identity. function sendIdentity identity, QuickAccount calldata acc, DualSig calldata...