Decoding ERC20 transfer with ERC20 short address attack
- Dominant language
- Python
- Stars
- 5.5k
- Forks
- 1.7k
- Avg merge
- 3d 10h
- Merged PRs (30d)
- 2
Description
* Version: 5.11.1
* Python: 3.8
* OS: linux
### What was wrong?
When trying to decode transaction `data` using `Contract.decode_function_input` a `InsufficientDataBytes: Tried to read 32 bytes. Only got 31 bytes` is raised. That data is executed by the EVM and I would expect to see it decoded by web3.y, yet it's a [ERC20 Short address attack](https://vessenes.com/the-erc20-short-address-attack-explained/)
Transaction data is an ERC20 `transfer` `0xa9059cbb0000000000000000000000002c4db8a83f7ae70c00548c53ac55579b9a8744e50000000000000000000000000000000000000000000002c182040d8f7d0000` and you can see it executed on [the trace 0-0-1](https://etherscan.io/vmtrace?txhash=0x66674c095e636a7e581cfcc968f0c499fedb90c44730cc7b7a94ff7f696bea35&type=parity#raw)
### How can it be fixed?
Decoding correcly the data and adding missing bytes of the address as the EVM does. Maybe it's a bug of `eth_abi` and not related to `web3.py`, let me know in that case
Contributor guide
Assessment
This issue has not been assessed yet.