Lack of input validation in delegateBySig
```\\nfunction delegateBySig(\\n    address delegatee,\\n    uint256 nonce,\\n    uint256 expiry,\\n    uint8 v,\\n    bytes32 r,\\n    bytes32 s\\n) public {\\n    require(block.timestamp <= expiry, "ERC20MultiVotes: signature expired");\\n    address signer = ecrecover(\\n        keccak256(\\n            abi.encodePacked(\\n                "\\x19\\x01",\\n                DOMAIN\\_SEPARATOR(),\\n                keccak256(abi.encode(DELEGATION\\_TYPEHASH, delegatee, nonce, expiry))\\n            )\\n        ),\\n        v,\\n        r,\\n        s\\n    );\\n    require(nonce == nonces[signer]++, "ERC20MultiVotes: invalid nonce");\\n    \\_delegate(signer, delegatee);\\n}\\n```\\n
Introduce a zero address check i.e `require signer!=address(0)` and check if the recovered signer is an expected address. Refer to ERC20's permit for inspiration.
```\\nfunction delegateBySig(\\n    address delegatee,\\n    uint256 nonce,\\n    uint256 expiry,\\n    uint8 v,\\n    bytes32 r,\\n    bytes32 s\\n) public {\\n    require(block.timestamp <= expiry, "ERC20MultiVotes: signature expired");\\n    address signer = ecrecover(\\n        keccak256(\\n            abi.encodePacked(\\n                "\\x19\\x01",\\n                DOMAIN\\_SEPARATOR(),\\n                keccak256(abi.encode(DELEGATION\\_TYPEHASH, delegatee, nonce, expiry))\\n            )\\n        ),\\n        v,\\n        r,\\n        s\\n    );\\n    require(nonce == nonces[signer]++, "ERC20MultiVotes: invalid nonce");\\n    \\_delegate(signer, delegatee);\\n}\\n```\\n