Let's think about this code:

function publishEtherBox (bytes32 _label, string _ownerUrl, uint _lifespan) external onlyWhenRunning() payable {
      require(ownerToEtherBoxes[msg.sender].length < 10);
      assert(bytes(_ownerUrl).length <= 200);
      address etherBoxAddress = address(keccak256(msg.sender, now));
      etherBoxes[etherBoxAddress] = EtherBox({
        label: _label,
        owner: msg.sender,
        ownerUrl: _ownerUrl,
        expiration: now + _lifespan
      emit EtherBoxPublished(msg.sender, nicknames[msg.sender], etherBoxAddress, _label, now);
      if(msg.value > 0){ owner.transfer(msg.value); }

referring to the 4th line, it is obvious the it might lead to an output coincidence if multiple transactions from the same msg.sender are packed in the same block on the same timestamp. How to avoid that and what's the chance of getting the same behaviour using a proggressive nonce instead of now?

1 Answer 1


If the same account calls this function twice in the same block, the odds are 100% that keccak256(msg.sender, now) will return the same value.

If you hash a nonce that increases each time publishEtherBox is called, the odds of a collision are approximately 0%. You're taking 20 bytes of the hash output, which is what Ethereum itself uses to generate accounts. The math shows that it's almost impossible to generate a duplicate account, and thus it's almost impossible for your etherBoxAddress to be a duplicate if you use a nonce.

  • can you think some other way that a hacker could run to take owership of an EtherBox struct? here it is the entire code: etherscan.io/address/…
    – user38075
    Jun 9, 2018 at 18:39
  • 1
    I charge ~$500/hour to do security audits.
    – user19510
    Jun 9, 2018 at 18:43
  • I build the contract just for fun, I don't feel like it's a good investment right now. But thanks for the answer
    – user38075
    Jun 9, 2018 at 19:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.