Replay Attack

Overview

Replay attacks exploit systems that verify authenticity but do not adequately verify freshness, uniqueness, or context. An attacker captures a valid signed request, authentication exchange, payment instruction, or blockchain transaction and presents it again.

A signature can remain mathematically valid during replay because the original signer genuinely authorized the captured data. Exposure increases when messages lack nonces, timestamps, sequence numbers, expiration, chain identifiers, session binding, or records of prior use.

Protocols should bind authorization to a unique domain and intended action, reject used identifiers, enforce suitable time windows, and store replay state reliably. Cross-chain, cross-contract, cross-environment, and restored-backup scenarios need explicit separation because identical credentials may exist in several contexts.

Replay Attack is an attack or weakness pattern that resubmits a previously valid message or transaction so a system performs an authorized action again unintentionally. Authenticity does not guarantee freshness; replay resistance requires unique context, bounded validity, and reliable detection of previously accepted messages.

Assessment of Replay Attack should trace an attack or weakness pattern that resubmits a previously valid message or transaction so a system performs an authorized action again unintentionally from prerequisite and entry point through observable impact on the affected service. A theoretical weakness or scanner result involving attack should not be reported as exploitation without corroborating logs, transactions, or configuration evidence. Prevention, detection, containment, and recovery for the Replay attack path should be tested against the architecture associated with attack.

Retesting for Replay Attack should reproduce the Replay attack path involving attack, examine adjacent paths, and verify the conditions for safely returning the affected service to normal operation.