26

I'm interested in knowing whether any particular address is a contract address or a standard address. There have been similar questions on the topic, but I'm not looking to detect whether an address is valid as this is child's play.

I assume detecting a contract can be done, Etherscan does a good job at detecting addresses vs contracts.

Any ideas? Can this be done with web3?

27

you can use getcode function.
if the address is representing an External Owned Account you will get 0x as response otherwise you will get the contract's bytecodeode. for example :

web3.eth.getCode("0xa5Acc472597C1e1651270da9081Cc5a0b38258E3")
"0x"
  • 3
    I notced that ganache actually returns '0x0'... – Miao ZhiCheng Apr 22 '18 at 10:27
2

I read in one of the future updates they plan to make simple addresses be implemented as smart contracts (unifying and making things simpler) so while you might be able to do this now, it may not be possible once POS lands.

  • How would that work though? Smart contracts don't have private keys... – Sandwich Oct 23 '17 at 11:57
  • 1
    @Sandwich with account abstraction (all accounts are contracts) the signature validation is part of the contract code itself instead of part of the node software. So you would probably include the signing address in the deployment code and you would validate a transaction within the contract – flygoing May 17 at 13:34
1

There's a command line tool from QuickBlocks called isContract which returns true/false given an address.

isContract 0xd26114cd6ee289accf82350c8d8487fedb8a0c07

from the command line returns true. (The address is Omisigo.)

1

To add to Thomas Jay Rush's answer, QuickBlocks seems to be now Qblocks.

GitHub Link: https://github.com/Great-Hill-Corporation/trueblocks-core/blob/master/src/other/install/INSTALL.md

Website: https://quickblocks.io

Also, refer to my answer at this link.

0

Adding an answer for others who come across this.

Unpopular opinion: Don't do it, because you can't do it.

Methods based on the assumption that code size of zero reliably implies that the caller must be an EOA will probably introduce a security risk. This is because a constructor can make such a call the constructor's address will return length 0 because no code is deployed there, yet.

Is that automatically a tragic defect? Not necessarily, but probably.

Let's break it down.

  1. Let us assume that one is doing this for a reason. There must be some valid concern or else this attempt at discrimination would needlessly complicate matters.
  2. But, there is a way to circumvent the effort.
  3. The check, itself, points right at the section of code the author is concerned about, the whatever vulnerability might exist there should be easy to spot.
  4. A requirement to deploy a special contract to exploit the vulnerability is trivial.

All in all, it seems like a bad idea to patch over another bad idea. Whatever the concern is, work on eliminating it. Accepting other contracts as full participants has advantages and fighting it will probably lead to trouble.

To the best of my knowledge @AnAllergyToAnalogy was first to point out the problem with the code size strategy.

How does a contract find out if another address is a contract?

Hope it helps.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.