6

Recently PillarProject reported an issue where there was collision (?) of sort. Apparently their smart contract address on Rinkeby testnet matched with real address on the mainnet.

I am aware that smart contract addresses don't have private key perse. These are generated via a deterministic algorithm that takes into account

  1. address of the creator (sender)
  2. how many transactions the creator has sent
  3. And this is hashed with Keccak-256.

Now theoretically if I were to create a real address on a testnet and assuming that this address matches with a smart contract address on the mainnet. If I were to import my private key to mainnet from any of the ethereum client nodes. Would I have access to the smart contract ether as well?? Is this possible? Or am I talking nonsense??

Lets take the example of Pillarproject itself. If the person having access to the address on the mainnet were to import his address onto rinkeby. What would happen?

Any thoughts?

  • Yes, it is possible to control a smart contract account if you have its private key. However, this is very very unlikely to happen. – jeff Jul 10 '17 at 18:14
  • Wouldn't this be a serious bug then? If by chance I have access to a private key on testnet which matches that of a smart contract on the mainnet. Then I can take away all the funds from the smart contract, can't I? – Parthasarathy Ramanujam Jul 10 '17 at 18:16
  • Yes, you can. This applies to any EOA too. The security comes from the fact that this is very very unlikely, or requires an unreasonable amount of computational power. If it did happen, it wouldn't be considered a bug, though, it is expected behavior :) Although it would still surprise a lot of people, including me. Here is an example where someone got close, but turned out it was a hoax, (kind of a bug) in Parity. – jeff Jul 10 '17 at 18:23
2

I think this answer might be what you are looking for.

Is each Ethereum address shared by (theoretically) 2 ** 96 private keys?

There is no difference between testnet accounts and main-net accounts, you can move accounts between them, but of course transactions done in one net have not happen on the other.

Contracts live on the block chain, so they are unique to the current test/main network. if someone (speculating) creates a contract with the same address as a contract on another network, it doesn't mean anything and doesn't grant them any powers to the contract with the same address on the other network.

It's the contract owner account private key that is important (as the creator/owner).

  • In Pillar's case the clash is between a real address on mainnet and a contract address on the testnet. You have a private key to a real address but not to a contract address. – Parthasarathy Ramanujam Jul 10 '17 at 18:23
0

It's important to understand that a keypair is a keypair: it isn't tied to a particular network. If you own a private key, you can use it on any network, it's just that one network won't know what you did on another, but the address itself is valid. So in the context of your question I wouldn't talk of collision, which means a completely different thing in cryptography.

Now, if you want to avoid mistakes, specifically naming the network along with an address, you should take a look at MNIDs (multi-network identifiers) which allow to use a different address for a same public key depending on the network. Do understand that at key level the keypair stays the same, though.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.