2

Does anybody know something about this? I know that in general terms we will say not, but looking on the internet I found that isn't sure the answer to the question: Can the EVM’s Internal Associative Array be Exploited?.

Which makes more sense, because a Hash Table poisoning attack may be "impossible" in terms of gas costs (at least this is how I see it, I'm not an expert on this subject)

If anyone knows about this, or any papers/articles related it'll be appreciated.

Thanks on advice!

1

Found some info here: https://www.reddit.com/r/ethereum/comments/3k4h3w/basic_questions_about_the_ethereum_evm_and_state/

Maybe you can start by reading this.

EVM memory is transient. The EVM is not really a virtual machine (VM has a strong connotation for many) - it's just an interpreter for the EVM assembly language. As the interpreter runs, it maintains a stack (where each element is 32 bytes) and a memory byte-array, and has access to the contract's storage tree. The stack and memory byte-array are dropped when the execution completes. But yes, every single node runs the transaction - at any point in the execution, the state of the stack, the memory-byte array, the program counter, and the storage should be identical on each node.

Hope it helps a bit.

3

Found this article, maybe is interesting for you!

https://hackernoon.com/are-ethereum-contracts-vulnerable-to-hash-table-poisoning-attacks-a4d9241e16c4

  • 1
    Hi there. Link-only answers are discouraged because the link could go dead or be moved at any time. Could you summarise the contents of the link in an answer? – Richard Horrocks May 18 '18 at 18:48
2

I wrote the article (Are Ethereum Contracts Vulnerable to Hash Table Poisoning Attacks?) linked by kr0.

The short and sweet of it is solidity mapping types are not hash tables. They don't hash the key, mod that hash into a predictable location in a smaller array. They fully SHA3 (or more specifically the variant keccak256) the key AND the memory address of the map itself and store the value in the contract's 2^256 sized virtual memory space. So collisions would require collisions in SHA3 itself.

This is also why you can't iterate over the mappings.

  • 1
    WHOOO!! Appreciated man, nice job with that work. – CPereez19 Nov 20 '18 at 8:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.