Skip to content
This repository was archived by the owner on Mar 5, 2025. It is now read-only.

Commit f196996

Browse files
Update soliditySha3 docs (#3908)
* Update soliditySha3 docs * Added Security risk warning
1 parent 06610f2 commit f196996

File tree

2 files changed

+17
-0
lines changed

2 files changed

+17
-0
lines changed

CHANGELOG.md

+1
Original file line numberDiff line numberDiff line change
@@ -356,6 +356,7 @@ Released with 1.0.0-beta.37 code base.
356356
### Added
357357

358358
- Github action for running tests for `web3-eth2-core` and `web3-eth2-beaconchain` packages (#3892)
359+
- Added Security risk warning to docs for `web3.utils.soliditySha3` (#3908)
359360

360361
### Changed
361362

docs/web3-utils.rst

+16
Original file line numberDiff line numberDiff line change
@@ -319,6 +319,8 @@ soliditySha3
319319
Will calculate the sha3 of given input parameters in the same way solidity would.
320320
This means arguments will be ABI converted and tightly packed before being hashed.
321321

322+
.. warning:: This method poses a security risk where multiple inputs can compute to the same hash. Provided in the example code are multiple cases of this security risk
323+
322324
----------
323325
Parameters
324326
----------
@@ -344,6 +346,20 @@ Example
344346

345347
.. code-block:: javascript
346348
349+
// As a short example of the non-distinguished nature of
350+
// Solidity tight-packing (which is why it is inappropriate
351+
// for many things from a security point of view), consider
352+
// the following examples are all equal, despite representing
353+
// very different values and layouts.
354+
web3.utils.soliditySha3('hello','world01')
355+
// "0xfb0a9d38c4dc568cbd105866540986fabf3c08c1bfb78299ce21aa0e5c0c586b"
356+
web3.utils.soliditySha3({type: 'string', value: 'helloworld'},{type: 'string', value: '01'})
357+
// "0xfb0a9d38c4dc568cbd105866540986fabf3c08c1bfb78299ce21aa0e5c0c586b"
358+
web3.utils.soliditySha3({type: 'string', value: 'hell'},{type: 'string', value: 'oworld'},{type: 'uint16', value: 0x3031})
359+
// "0xfb0a9d38c4dc568cbd105866540986fabf3c08c1bfb78299ce21aa0e5c0c586b"
360+
web3.utils.soliditySha3({type: 'uint96', value: '32309054545061485574011236401'})
361+
// "0xfb0a9d38c4dc568cbd105866540986fabf3c08c1bfb78299ce21aa0e5c0c586b"
362+
347363
web3.utils.soliditySha3('234564535', '0xfff23243', true, -10);
348364
// auto detects: uint256, bytes, bool, int256
349365
> "0x3e27a893dc40ef8a7f0841d96639de2f58a132be5ae466d40087a2cfa83b7179"

0 commit comments

Comments
 (0)