Variable-width concatenation can erase field boundaries.
LET’S PICTURE IT
Removing separators can make two different forms print the same text.
SEE IT FOR YOURSELF
Build a transfer call from typed fieldsStep 1 / 4
The standard transfer interface takes an address and a raw integer amount. This diagram uses address one and amount one hundred.
The standard transfer interface takes an address and a raw integer amount. This diagram uses address one and amount one hundred.Keccak-256 of the canonical signature supplies the first four bytes. The transfer selector is a9059cbb.An address is twenty bytes. Standard ABI encoding adds twelve zero bytes on the left to fill one thirty-two-byte word.The integer one hundred is hex 64, left-padded in word one. Selector plus two words produces sixty-eight bytes of standard calldata.
Animated local teaching model. No wallet, RPC or live blockchain data. Some labels and hashes are abbreviated for readability.
Construct the ambiguity
Packed string pairs a with bc and ab with c both produce the bytes abc. This equality exists before hashing.
Distinguish from a hash break
Hashing identical byte input gives identical output normally. No attacker needs to defeat Keccak to exploit a protocol that meant those logical records to differ.
Use a reviewed structured encoding
Standard ABI encoding or another unambiguous typed format can preserve boundaries. Ensure the signing, commitment or proof verifier uses the same format.
Test field-boundary changes
Generate distinct logical records that differ in where variable-length fields split. Their intended commitments should differ under a well-specified schema.
Work through the boundary
packed("a","bc") = 0x616263
packed("ab","c") = 0x616263
Specify boundaries before hashing.
A simplified local review scenario. The example establishes a question to test, not a guarantee of production safety.
QUICK CHECK · NO PRESSURE
Is this ambiguity itself a cryptographic collision attack?