Skip to content
This repository has been archived by the owner on May 23, 2023. It is now read-only.

Broken argument positions cause method to repeat almost infinitely #882

Open
snail-fuji opened this issue Jun 4, 2018 · 1 comment
Open

Comments

@snail-fuji
Copy link

snail-fuji commented Jun 4, 2018

Hello, guys! I've got a problem with input decoding, can you help me with it?

from ethereum.abi import decode_abi
from ethereum.utils import decode_hex    
arg_types = ['address[4][]', 'uint256[6][]', 'uint8[1][]', 'bool[]', 'uint8[]', 'bytes32[]', 'bytes32[]', 'address', 'uint16']
call_data = "0xe78aadb20000000000000000000000000000000000000000000000000000000000000120000000000000000000000000000000000000000000000000000000000000024000000000000000000000000000000000000000000000000000000000000003e0000000000000000000000000000000000000000000000000000000000000044000000000000000000000000000000000000000000000000000000000000004a0000000000000000000000000000000000000000000000000000000000000054000000000000000000000000000000000000000000000000000000000000005a0000000000000000000000000b94065482ad64d4c2b9252358d746b39e820a5820000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000000000000087c6117ef0935b1df3f9d93d9b39516eb8141870000000000000000000000000ef68e7c694f40c8202821edf525de3782458639f000000000000000000000000b94065482ad64d4c2b9252358d746b39e820a58200000000000000000000000057c3153be7cee64da0244da98902a6a0fbd6f5d30000000000000000000000008c82798e7e491e9bf6e6e28e2bc31f781d1175a2000000000000000000000000c02aaa39b223fe8d0a0e5c4f27ead9083c756cc2000000000000000000000000b94065482ad64d4c2b9252358d746b39e820a5820000000000000000000000006e79fe67d43095e6b95f00beeaa4a89a3db6385200000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000001bc16d674ec8000000000000000000000000000000000000000000000000000000071afd498d0000000000000000000000000000000000000000000000000000000000005afeace4000000000000000000000000000000000000000000000000000000005afebaf400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001bc16d674ec8000000000000000000000000000000000000000000000000000000071afd498d00000000000000000000000000000000000000000000000000001bc16d674ec80000000000000000000000000000000000000000000000000000000000005afead23000000000000000000000000000000000000000000000000000000005afebb33000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000071afd498d00000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000004000000000000000000000000000000000000000000000000000000000000001b000000000000000000000000000000000000000000000000000000000000001c000000000000000000000000000000000000000000000000000000000000001b000000000000000000000000000000000000000000000000000000000000001b00000000000000000000000000000000000000000000000000000000000000046447466b00ad173ecad372d3711943e0a2677af6a3baa7012e8b88864bd47818669ba4472872c03574a240ec7b5527298c52cc2ff75cdeb9e2c157ca0f6eff1d09e9e13fd62097527e71280de3e8c091d7f7b788e21a19118f8c397c94f756d4701f9a3805f5ccdda2449ac0a798089cd4bac15622b6ba7227785ddb0afbb9cd000000000000000000000000000000000000000000000000000000000000000419380a2a3e0ad8a6073c2d36b40d4a469a1111cc6f83fab69293f70559821da655a3443ab90d9233670f4aff0ab12519364056ca6ab0323c9f9d0188b3b37a7e4e02281ddc6a197e149c4c1684cae2fb6536fb319b6ded4ee1574d33b5836d36252d5633c682288c913e7e44a2ff729df463cfb1f4fb0334e8b6270778ce9093"
call_data_bin = decode_hex(call_data)
inputs = decode_abi(arg_types, call_data_bin[4:])

So, this code stucks for a long time.
I use pyethereum 2.3.1, python3 and ubuntu 16.04

Thanks in advance!

@snail-fuji
Copy link
Author

snail-fuji commented Jun 4, 2018

Seems like argument positions in transaction are invalid, and the second bytes32[] array tries to interpret wrong byte sequence as length:

  • Argument position says that the argument data starts from 1440
    ...
    [5]: 0000000000000000000000000000000000000000000000000000000000000540
    [6]: 00000000000000000000000000000000000000000000000000000000000005a0
    [7]: 000000000000000000000000b94065482ad64d4c2b9252358d746b39e820a582
    ...

  • Value in the first 32 bytes for this position says: "WTF is going on?!?!"
    ...
    [41]: 000000000000000000000000000000000000000000000000000000000000001b
    [42]: 0000000000000000000000000000000000000000000000000000000000000004
    [43]: 6447466b00ad173ecad372d3711943e0a2677af6a3baa7012e8b88864bd47818
    [44]: 669ba4472872c03574a240ec7b5527298c52cc2ff75cdeb9e2c157ca0f6eff1d
    Length is read from this position
    [45]: 09e9e13fd62097527e71280de3e8c091d7f7b788e21a19118f8c397c94f756d4
    [46]: 701f9a3805f5ccdda2449ac0a798089cd4bac15622b6ba7227785ddb0afbb9cd
    But it stored there
    [47]: 0000000000000000000000000000000000000000000000000000000000000004
    [48]: 19380a2a3e0ad8a6073c2d36b40d4a469a1111cc6f83fab69293f70559821da6
    ...
    Maybe, it'll be helpful to add a timeout or an assertion (i.e. assert length <= positions_difference) to prevent such cases.

The original transaction can be found here: https://etherscan.io/tx/0x9f053648f7e6a6e6a89ce3f5524dab3c21a2368aa16c69dce0182395c5a54831

And it's not alone in ethereum blockchain :( There are plenty of transactions with broken argument positions. Maybe, I missed something in a standard?

@snail-fuji snail-fuji changed the title Method stucks for a long time Broken argument positions cause method to repeat almost infinitely Jun 4, 2018
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant