Zodiac Reveals ERC-1271 Signature Verification Flaw

On June 20, 2026, the Zodiac team disclosed a security flaw in the ERC-1271 transaction signature verification logic. The vulnerability allows the system to determine signature validity based solely on a returned 'magic value' without confirming the success of the call itself. This oversight can lead to failed verifications being misrepresented as valid signatures, effectively bypassing the module's authentication mechanism. The flaw affects the Zodiac Roles Modifier, potentially exposing users to unauthorized access. No specific CVEs have been reported in the articles, and the current status of the vulnerability remains unclear. Security teams are advised to review their implementations of ERC-1271 to mitigate any risks associated with this flaw.

Key Points: • Zodiac disclosed a critical flaw in ERC-1271 signature verification logic. • The vulnerability allows failed verifications to be misrepresented as valid signatures. • No specific CVEs have been reported, but security teams should assess their systems.