From what I read there's a well public knowledge of reantrancy and underflows/overflows due to the cases of documented hacks and stolen ether - yet the short address attack seems less known. I know in order to protect against it in my contract I should add something like:

contract okcontract {
    modifier noshortaddress(uint size) { 
          assert(msg.data.length >= size + 4);
}function transfer(address _to, uint256 _value) noshortaddress(2 * 32) {
     // do stuff   

So since the attack is dependent on the EVM: is there a fix in the EVM against it or is it still code based? I know an attack like that will be impossible to launch from any credible exchange/wallet since they will not except a "weird" address, in this case: address shorter than 42 characters (0x + the hash, in the case of short address it will be 40 total: 0x + 38 - 00 or maybe even 36: 0x + 36 - 0000 ... etc depending on how lucky one is to generate address with zeroes on the end).

Finally: is it sufficient to just put a withdraw function before the end since the request will be sent into bytes to the EVM and the last byte added will be to some other fuction making it impossible? In other words: contract where after "withdraw" I have say "check-balance" or any other function is safe since no byte added to this will result into address with higher balance? Thank you!

  • 1
    AFAIK, you should be safe as long as you're using an updated version of web3.js (this exploit is essentially on the off-chain side, in a rather old version of web3.js). – goodvibration Oct 29 '19 at 17:41

Since solidity v0.5.0 it is not necessary anymore. From the changelog:

Code Generator: Revert at runtime if calldata is too short or points out of bounds. This is done inside the ABI decoder and therefore also applies to abi.decode().

Executing a function with less than required makes the transaction fail. Although you can send more data and it work, the extra data is ignored.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.