ECDSA.sol recover() returns different address than ecrecover()

I may be going crazy, but it seems like ECDSA.recover() and ecrecover() return different addresses.

🔢 Code to reproduce bug Here’s what I get from web3.accounts.sign():

{ message: 'This is a signed message',
  messageHash:
   '0x7aa10675d70f58a5e7427fdc02dfd8207ec1c637163aa974382c683fea3df843',
  v: '0x1b',
  r:
   '0xf0150782e269d731548e9fe92eadd90e6178bcd7d2c948b2583e132020f8b44d',
  s:
   '0x23c27ecea23c7d9579807b2f574430fb5be4266ab50945c1c509bf04212d1294',
  signature:
   '0xf0150782e269d731548e9fe92eadd90e6178bcd7d2c948b2583e132020f8b44d23c27ecea23c7d9579807b2f574430fb5be4266ab50945c1c509bf04212d12941b' }

Here’s the solidity code:

function verify(bytes32 hash, bytes memory signature) public view returns (address){
        return ECDSA.recover(hash, signature);
    }
    

function testRecovery(bytes32 h, uint8 v, bytes32 r, bytes32 s) public view returns (address) {
      bytes32 prefixedHash = keccak256(abi.encodePacked("\x19Ethereum Signed Message:\n32", h));
      address addr = ecrecover(prefixedHash, v, r, s);

      return addr;
  }

📝 Details Is this even possible? I thought keccak was collision-resistant!

💻 Environment

Latest OpenZeppelin, solidity 0.5.0, local Ethereum (pre-Constantinople, not mainnet, if that matters)

[jdowning100]

Hello @jdowning100! I believe the issue is that you’re recovering two different hashed messages: in the ECDSA test you provide the same hash value as you do for h in the ecrecover test, but this second one doesn’t expect a hash like ECDSA does, but a message instead (which it then hashes).

That’s actually not true - ecrecover() expects a hash of the message: https://github.com/ethereum/solidity/blob/develop/docs/units-and-global-variables.rst#mathematical-and-cryptographic-functions But anyways, I discovered what I did wrong. The ECDSA contract has a function toEthSignedMessageHash() for prefixing the message hash with the proper “\x19Ethereum Signed Message:\n32” prefix but the function is unused. When I call toEthSignedMessageHash(hash) in recover() it works. (I should also note that web3.eth.accounts.sign adds the prefix, while web3.eth.sign does not, which is totally ridiculous)

[frangio]

@maksimjeet20566 Please create a topic in our forum and share the code that you’re using to generate and verify the signature.