ApeWorX / ApeWorX/web3.py

Decoding ERC20 transfer with ERC20 short address attack

Đang mở
#1,678 2 bình luận 0 reaction 0 người được giao Xem trên GitHub
Ngôn ngữ chính
Python
Star
5.5k
Fork
1.7k
Merge trung bình
3 ngày 10 giờ
Pull request đã merge (30 ngày)
2

Mô tả

* Version: 5.11.1
* Python: 3.8
* OS: linux

### What was wrong?

When trying to decode transaction `data` using `Contract.decode_function_input` a `InsufficientDataBytes: Tried to read 32 bytes. Only got 31 bytes` is raised. That data is executed by the EVM and I would expect to see it decoded by web3.y, yet it's a [ERC20 Short address attack](https://vessenes.com/the-erc20-short-address-attack-explained/)

Transaction data is an ERC20 `transfer` `0xa9059cbb0000000000000000000000002c4db8a83f7ae70c00548c53ac55579b9a8744e50000000000000000000000000000000000000000000002c182040d8f7d0000` and you can see it executed on [the trace 0-0-1](https://etherscan.io/vmtrace?txhash=0x66674c095e636a7e581cfcc968f0c499fedb90c44730cc7b7a94ff7f696bea35&type=parity#raw)

### How can it be fixed?

Decoding correcly the data and adding missing bytes of the address as the EVM does. Maybe it's a bug of `eth_abi` and not related to `web3.py`, let me know in that case

Hướng dẫn đóng góp

Mở hướng dẫn đóng góp

Đánh giá

Issue này chưa được đánh giá.

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.