# Any signature is valid before the issuer address is set Crit/High · Three Sigma · Social money games · 13th June, 2024 Finding 3S-D1-M04 of the DistrictOne security review. - Protocol: https://districtone.io/ - Report: /reports/districtone - Source: https://cdn.sanity.io/files/qoqld077/production/fd2142f1d189dd29db23dff49d4018d4da9c01d6.pdf --- ### Description The issuerAddress in the FairLauncher and TokenVault is not set in the constructor and the signature libraries do not check if ecrecover returns address(0). Thus, before the issuerAddress is set, it is possible to forge signatures. This could be problematic for example in the TokenVault as there is no on chain balance tracking, so users may withdraw all the balance. However, this is not very likely because honest users will not deposit in the TokenVault if the issuerAddress has not been set. ### Recommendation Either set the issuerAddress in the constructor or revert if ecrecover() returns address(0). ### Status Addressed in [#9211325](https://github.com/DistrictOneDev/districtone-contracts/commit/92113258822fd85593dc566e54e0b4b82a992537). --- Related findings: - [PriceFeed: First owner isn't set as valid keeper](https://0xsimao.com/findings/nftperp-i-price-isn-valid-keeper): Nftperp Exchange