I'm writing a contract for an ERC20 token, based on Zepellin contracts. I noticed that their code doesn't handle the short address attack. Does it mean I shouldn't care about it?
There was a discussion about that.
Main reason is that it is a vulnerability of other contracts, and not token itself. It's their work to check all arguments. So yes, you should not care about it as token developer, but should care as contract developer).