Authenticating users in contracts

Question

I'm aware I could tell which wallet address is calling the contract and whitelist certain addresses. But how could I instead make a contract that can only be used by people who hold a certain secret key? I was thinking of a standard hashed password mechanism but with something to protect against replay attacks, since everything on-chain is publicly visible. Searching around, I found this article using that for a secrets store, and here's the code.

1. I generate a secret and pass it out.
2. User hashes their secret with a nonce the contract stores.
3. User calls contract method with the hash and whatever other params.
4. Contract increments nonce so the hash can't be reused.

But what happens if the method call fails? Won't everyone (or at least some node operators) see the failed call with its params and be able to reuse the hash from it, since the contract's nonce never got incremented?

Edit: Oh, the caller could just include the wallet address in the hash so nobody else can use that hash. Though I'm still curious about whether or not there's a vulnerability in the original solution.

Answer 1

Yes, the original solution is unsafe. Cross checking the sender address of the hash is really important. Infact, the recent Wormhole Hack on a Solana contract was caused due to a vulnerability closely related to what you described.

Answer 2

You might want to have a look at the solution used in the Multisig contract supported by tezos-client. It is documented here.

In essence:

• you can check signatures in Michelson using the CHECK_SIGNATURE instruction.
• to prevent replay, you need to enrich the message with three pieces of data: a counter (stored in the contract, incremented at each call), the address of the contracts (as computed by the SELF_ADDRESS instruction), and the id of the chain on which the contract lives (as computed by the CHAIN_ID instruction).