2

I always assumed that Ethereum addresses were, more or less, uniformly (randomly) distributed over their 40-char hex representation.

Is that not the case?

I've found these 2 addresses that only differ in their first character.

0x0520cb868B5bb977F51C8Ad85A4D38f904A09007
0x9520cB868B5BB977F51c8aD85a4D38F904a09007

The chances of this happening (birthday paradox) are so small, it's next to impossible if distribution is indeed somewhat uniform.

A simpler calc (or at least one that I how to calculate here) is too check the chances of, say, the 20-char suffix (= 16^20 = 2^80 or 80 bits of info) of 2 items colliding in the supposed uniform distribution. Chances of 1 collision with 200M items (about the number of ethereum addresses which have activity on Etheruem mainnet) is ~1.6543e-8

Only conclusion must be that distribution is not near uniform.

Now a public ethereum address is generated in a couple of stages (steps from here :

  1. given a 64-char hex private key (256 bits of info)
  2. generate public key from private key using Elliptic Curve Signature algo
  3. taking the last 20 bytes of the Keccak-256 hash of the public key and adding 0x to the beginning

Now, I've found this article suggesting that step 3 (taking the Keccak-256 hash) results in a good randomly uniform distribution.

So, only step 1. or step 2. limit randomness here. Anyone?

5
  • You got these two addresses generated by yourself, or you just found them online?
    – Sky
    Jan 12, 2023 at 20:59
  • Found them online
    – Geert-Jan
    Jan 12, 2023 at 20:59
  • Online, in some register of addresses?
    – Sky
    Jan 12, 2023 at 21:00
  • As part of indexing all Ethereum transactions, I encountered this collision, based on my assumption that I could encode ethereum addresses with less entropy than their original 160 bits. Turns out I am wrong. I'm pretty sure this is not a unique case, but this one tripped all the wires.
    – Geert-Jan
    Jan 12, 2023 at 21:02
  • Yeah, I think more realistic explanation is that somene made a typo, there are likely a numbers of such addresses.
    – Sky
    Jan 12, 2023 at 22:10

2 Answers 2

2

This hasn't happened. I'm almost sure for the https://etherscan.io/address/0x0520cb868B5bb977F51C8Ad85A4D38f904A09007 nobody has the private key. There is only one incoming transaction, and I think they wanted to send funds to that another one 0x9520cb868B5bb977F51C8Ad85A4D38f904A09007 address but missed the first 9 (0 was prepended automatically). There is an ERC20 token at the address, but it was just airdropped in a batch.

2
  • Ah that could be the reason. You assume no access to private key based on no transfers out at all?
    – Geert-Jan
    Jan 12, 2023 at 21:22
  • 1
    Right. 1 No transfers out. 2. Both addresses were "active" (that one with 0x05.. just received) at the same Date - 1809 days ago. 3. As you have already noticed the chances to generate two addresses with levenshtein distance of 1 at a similar point in time is not realistic.
    – tenbits
    Jan 12, 2023 at 21:30
0

ETH address has 160bits == 20Bytes == 40 charahters

So the odds of full address collision are 2^160

The chances for your case (collision in all but one character) are 2^156

A big number to be sure, but still "somewhat" plausible. But also a hell of a suspicious, if I am being honest.

1
  • Yeah. If was talking about the chance of any of the 200M addresses colliding, a change that the linked collision calculator cannot even approximate, so I did it with the half the length (=80 bits)
    – Geert-Jan
    Jan 12, 2023 at 20:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.