Chain-agnostic contract-wallet proofs claim credentials from uncontrolled deployments

[exromany]

Locations

• csm-widget/features/ics/apply-form/context/types.ts:3-7
• csm-widget/features/ics/apply-form/context/utils.ts:10-14
• csm-widget/features/ics/apply-form/context/use-verify-message.ts:32-54

Summary

ICS additional-address proofs do not identify the chain whose contract-wallet authority was proven. An applicant controlling an ERC-1271 wallet at an address on one chain can consequently receive ICS score for activity belonging to the differently controlled wallet at the same address on another chain.

Root cause

The additional-address model contains only address, signature, and browser-local verified state. generateAddressMessage binds the additional and main addresses but omits a chain or deployment identifier, while useRawVefiryMessage accepts the signature if either the current-network client or the additional Mainnet client validates it.

• The bound Survey API reconstructs the same chain-agnostic message and applies the same any-configured-client policy.
• Neither the request nor persisted application records which chain supplied the successful ERC-1271 result.
• Assessment later treats all submitted addresses as one set and checks it against both Hoodi and Mainnet credential sources.

Impact

An unprivileged applicant can borrow another operator's chain-specific history when the same contract address has divergent authorities across networks. Those points can satisfy ICS assessment thresholds, causing the applicant's main address to be approved and exported for an ICS Merkle proof despite lacking control of the deployment that earned the credited activity.

This can lead to an unauthorized on-chain ICS curve claim and its reduced collateral terms. Approval and publication remain operationally correctable, so the privileged bypass is medium severity.

Scenario

• Contract wallet C exists on Mainnet and Hoodi, with authority having diverged so applicant A controls only the Mainnet instance while another operator controls the Hoodi instance.
• The Hoodi instance of C owns an operator with qualifying CSM testnet history.
• A signs Verify ownership of address C for ICS with main address A through the Mainnet instance and submits C as an additional address.
• The chain-agnostic verifier accepts the Mainnet ERC-1271 result and stores C without provenance.
• Assessment finds C in the Hoodi owner data and credits its testnet experience to A's application.
• After the combined score passes review, A is exported into the Mainnet ICS tree and can claim the privileged curve.

---

Drafted from LidoLens finding ICS-APP-01