0

Let's think about this code:

function publishEtherBox (bytes32 _label, string _ownerUrl, uint _lifespan) external onlyWhenRunning() payable {
      require(ownerToEtherBoxes[msg.sender].length < 10);
      assert(bytes(_ownerUrl).length <= 200);
      address etherBoxAddress = address(keccak256(msg.sender, now));
      ownerToEtherBoxes[msg.sender].push(etherBoxAddress);
      etherBoxes[etherBoxAddress] = EtherBox({
        label: _label,
        owner: msg.sender,
        ownerUrl: _ownerUrl,
        expiration: now + _lifespan
      });
      emit EtherBoxPublished(msg.sender, nicknames[msg.sender], etherBoxAddress, _label, now);
      if(msg.value > 0){ owner.transfer(msg.value); }
  }

referring to the 4th line, it is obvious the it might lead to an output coincidence if multiple transactions from the same msg.sender are packed in the same block on the same timestamp. How to avoid that and what's the chance of getting the same behaviour using a proggressive nonce instead of now?

1

If the same account calls this function twice in the same block, the odds are 100% that keccak256(msg.sender, now) will return the same value.

If you hash a nonce that increases each time publishEtherBox is called, the odds of a collision are approximately 0%. You're taking 20 bytes of the hash output, which is what Ethereum itself uses to generate accounts. The math shows that it's almost impossible to generate a duplicate account, and thus it's almost impossible for your etherBoxAddress to be a duplicate if you use a nonce.

  • can you think some other way that a hacker could run to take owership of an EtherBox struct? here it is the entire code: etherscan.io/address/… – user38075 Jun 9 '18 at 18:39
  • 1
    I charge ~$500/hour to do security audits. – user19510 Jun 9 '18 at 18:43
  • I build the contract just for fun, I don't feel like it's a good investment right now. But thanks for the answer – user38075 Jun 9 '18 at 19:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy