Re:The bug which lost more than $600M in various cryptocurre...
by et2o on Thursday August 12, 2021 @06:22AM
(#28154404)
This is perhaps the most confusing element of it all, to me. I can hardly imagine a legitimate reason to do this. Defeats entirely the purpose of a hash.
Re:The bug which lost more than $600M in various cryptocurre...
by cesarb on Thursday August 12, 2021 @07:19AM
(#28154835)
If I understood it correctly, the purpose of this hash is just to shorten the method signature (name+types) to a 4 byte identifier. Unless a contract has thousands of methods, the chance of collision is very low (and the compiler could detect any collision, since it can see all methods). The "legitimate reason" for shortening the method signature is probably just to save space; bytes on distributed blockchain transactions are expensive.
Re:The bug which lost more than $600M in various cryptocurre...
by ed_elliott_asc on Thursday August 12, 2021 @06:31AM
(#28154476)
Checking whole hash was probably too slow, you can imagine they put in a check for first four bytes, if that matched then check the whole hash - probably merge conflict and lost the second bit - doesn’t seem too far fetched!
Re:The bug which lost more than $600M in various cryptocurre...
by thrwawy4345784 on Thursday August 12, 2021 @06:46AM
(#28154574)
Maybe somebody thought of short sha-1 id's of git: https://git-scm.com/book/en/v2/Git-Tools-Revision-Selection With that only 4 chars is enough to identify a commit :-)
Re:The bug which lost more than $600M in various cryptocurre...
by abstractbarista on Thursday August 12, 2021 @12:30PM
(#28158346)
This blew me away. That's 2^32. They took a cryptographic hash, with good preimage/second-preimage/collision resistance, and then discarded 7/8 of it before comparing to ensure some user-provided input is valid. What in the world?!
Either I want something to match, in which case check it all, or I don't care if it matches, in which case don't check at all.
Why would you ever check 4 bytes?
To me it smells like a way to prevent fuzzers stumbling on a deliberate loophole.