It's relatively common to confirm a msg.sender is pre-approved for some contract interaction by verifying a signed hash of their address and another parameter. For instance:

bytes32 checkHsh = keccak256(abi.encodepacked(msg.sender, someUint256));

The contract would then go on to recover the signer from a corresponding signed hash provided in the calldata.

The abi.encodePacked() function can produce duplicate hashes from variable length params (strings or variable length arrays) because it doesn't pad the args. e.g.

keccak256(abi.encodePacked('ban', 'ana')) == keccak256(abi.encodePacked('ba', 'nana'))

Question: Is there any way to make a duplicate hash using abi.encodePacked() params that are NOT strings or variable length arrays? i.e. can (_address, _uint256) args ever produce a duplicate hash? what about two (_uint256, _uint256) args?

(I have a feeling there is probably something with the zero address, but is there anything else?)


1 Answer 1


I would say no. This is because both uint256 and address have fixed lengths, unlike the other example you showed with strings where it's possible to change the string length.

To be more precise, an address variable has a fixed length of 20 bytes and a uint256 variable has a fixed length of 32 bytes. Therefore, it is not possible to produce duplicate hashes since you are not able to change the variable sizes.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.