ApeWorX / ApeWorX/web3.py

Decoding ERC20 transfer with ERC20 short address attack

Open
#1,678 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
5.5k
Forks
1.7k
Avg merge
3d 10h
Merged PRs (30d)
2

Description

* Version: 5.11.1
* Python: 3.8
* OS: linux

### What was wrong?

When trying to decode transaction `data` using `Contract.decode_function_input` a `InsufficientDataBytes: Tried to read 32 bytes. Only got 31 bytes` is raised. That data is executed by the EVM and I would expect to see it decoded by web3.y, yet it's a [ERC20 Short address attack](https://vessenes.com/the-erc20-short-address-attack-explained/)

Transaction data is an ERC20 `transfer` `0xa9059cbb0000000000000000000000002c4db8a83f7ae70c00548c53ac55579b9a8744e50000000000000000000000000000000000000000000002c182040d8f7d0000` and you can see it executed on [the trace 0-0-1](https://etherscan.io/vmtrace?txhash=0x66674c095e636a7e581cfcc968f0c499fedb90c44730cc7b7a94ff7f696bea35&type=parity#raw)

### How can it be fixed?

Decoding correcly the data and adding missing bytes of the address as the EVM does. Maybe it's a bug of `eth_abi` and not related to `web3.py`, let me know in that case

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.