3

I found this decompiler: https://ethervm.io/decompile and my code is :

function compareMyStrings(string memory a) public view returns (bool) {
    return (keccak256(abi.encodePacked((a))) == 'mySecretCodeString');
}

'mySecretCodeString', Can this string be cracked? Thank you very much!

1
  • This looks very close to how servers validate password hashes; you'd just compare keccak256(abi.encodePacked((a))) to the result of keccak256(abi.encodePacked(("mySecretCodeString"))), computed beforehand by you. E.g., if the result was 856c0bf2d9e8800cfb5e9819a262a663 (it's not), you'd do keccak256(abi.encodePacked((a))) == '856c0bf2d9e8800cfb5e9819a262a663' and it should properly validate the password. Just keep in mind that Keccak-256 isn't a password hash, so it's very fast to compute, so your password should be very long if you hope to achieve any real security with this. Aug 18 at 13:01

1 Answer 1

4

Yes, it can be cracked.

By the way, remember that at the moment that you send the correct secret word to the contract, to the compareMyStrings function, it will be visible by everybody while the transaction is sitting in the mempool. So, this is not secure at all.

Also, you are comparing the result of keccak256(abi.encodePacked((a))) which is a hash of 32 bytes, with the literal string "mySecretCodeString". That will never be true.

Maybe you meant:


contract Contract {
    function compareMyStrings(string memory a) public pure returns (bool) {
        return (keccak256(abi.encodePacked((a))) == keccak256(abi.encodePacked(("mySecretCodeString"))));
    }
}

This works. But it's a bad idea anyways.

Converting your "mySecretCodeString" to bytes, it shows: 6d79536563726574436f6465537472696e67

Try it yourself here: https://onlinestringtools.com/convert-string-to-bytes

enter image description here

If we search 6d79536563726574436f6465537472696e67 in your decompiled contract (I deployed the contract with your function and decompiled it here: https://ethervm.io/decompile/rinkeby/0x951874e72fa988119e21a19b2ab745baf9189d1d):

It shows:

enter image description here

So, the hardcoded string "mySecretCodeString" is still in your contract, just encoded in bytes.

Converting those bytes to string using https://onlinestringtools.com/convert-bytes-to-string, we see:

enter image description here

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.