[shahin-hq]

Security issues fixed

• Signatures were infinitely malleable. Only r/s were checked. Any v byte (00, 1d, zz), a missing v, or any trailing data still verified. So one valid signature had unlimited accepted string forms, which breaks any dedupe, replay or rate-limit check keyed on the signature string.
• Malformed input crashed instead of failing. Non-hex or short signatures, bad public keys and invalid UTF-8 threw ValueError/TypeError. These are Errors, not Exceptions, so typical catch (Exception) blocks missed them and returned 500s. That's attacker-triggerable error noise. Verification now fails closed with false.
• Validity depended on app-side checks. Correctness relied on each integrator adding its own regex. Moving that into the SDK removes the risk of an app forgetting it.

To be clear, no forgery was possible: r/s were always checked against the public key.

Compatibility fixes

• 0x-prefixed signatures from ARK Vault and the TS SDK failed to verify.
• v of 0/1, which ethers accepts, was rejected.
• Verification now matches the TS SDK: recover the signer's address and compare.

Checklist

• Documentation (if necessary)
• Tests (if necessary)
• Ready to be merged