Cube3

The function validateSignature() in the signature module is used for validating the signature present in the cube3SecurePayload. This signature is generated with multiple input parameters, while bearing in mind two important variables. One of them is a boolean value identifying whether nonce tracking is enabled or not, and another is the respective nonce if the tracking is indeed enabled.The fact that it is possible for a customer to choose whether they enable nonce tracking or not, a possibility to be vulnerable to signature replay attacks is presented. When nonce tracking is disabled, signatures can be replayed.For example, if a customer protected function implements logic for a user to receive 10 tokens, but nonce tracking was forgetfully left disabled, the same user can use the same signature and retrieve 10 more tokens an infinite number of times.